Executive brief
The ACPT (Premium) plugin for WordPress, used to build custom content types and user forms, is vulnerable to account takeover. An unauthenticated attacker can exploit a public user form to bypass authorization checks and modify any WordPress user's email address and password, including administrators, gaining full control of the site without requiring any authentication.
Technical details
The vulnerability is a missing authorization flaw in the plugin's submit() function that processes form submissions. The vulnerable code fails to verify user permissions before calling wp_update_user(), allowing an unauthenticated attacker to manipulate the target user ID parameter. An attacker can craft a malicious form submission to any publicly exposed ACPT user form and overwrite credentials for arbitrary accounts. The flaw affects all versions up to and including 2.0.66, with fixes released in version 2.0.67 and later per the official changelog which documents "strengthened REST API authentication" and fixes to "form submission issues that could let a public form overwrite the wrong record."
Affected products
- ACPT Premium up to and including 2.0.66
Timeline
- 2026-09-04: disclosed
- 2026-08-18: patched: Fix released in version 2.0.67