{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116624", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-10-26T17:25:03.004Z", "datePublished": "2026-11-06T11:17:38.056Z", "dateUpdated": "2026-11-06T11:17:38.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-06T11:17:38.056Z"}, "affected": [{"vendor": "danbilabs", "product": "Advanced Members for ACF", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` \u2014 unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()->submission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed."}], "title": "Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc38f0b-bf13-4d01-a4b3-38a43fc726d6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/acf/fields/class-user-password.php#L117"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/acf/fields/base/trait-amem-field.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/core/functions-forms.php#L105"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/core/actions/account.php#L227"}, {"url": "https://plugins.svn.wordpress.org/advanced-members/trunk/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3779180/advanced-members/trunk/acf/fields/class-user-password.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Adeyanju"}], "timeline": [{"time": "2026-10-26T17:39:36.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-11-05T21:55:11.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Advanced Members for ACF", "vendor": "danbilabs", "versions": [{"lessThanOrEqual": "1.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` \u2014 unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()->submission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed."}], "id": "CVE-2026-116624", "lastModified": "2026-11-06T12:17:17.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-11-06T12:17:17.340", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/advanced-members/trunk/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/acf/fields/base/trait-amem-field.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/acf/fields/class-user-password.php#L117"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/core/actions/account.php#L227"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/core/functions-forms.php#L105"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3779180/advanced-members/trunk/acf/fields/class-user-password.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc38f0b-bf13-4d01-a4b3-38a43fc726d6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"created": "2026-11-06T12:30:04.395530+00:00", "updated": "2026-11-06T12:30:04.395535+00:00", "vendors": []}