CVE-2026-14563
The advanced-customized-prompts WordPress plugin up to version 1.0.1 allows attackers to log in as any user without a password. This flaw lets them gain full access to the site, including administrative functions, or create new accounts. The vulnerability is critical because it requires no authentication and gives complete control.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress plugin advanced-customized-prompts, versions 1.0.0 through 1.0.1, used by WordPress sites that have installed the plugin.
Real-world impact
An attacker can impersonate any registered user, including administrators, and perform any action the user can, such as modifying content, installing plugins, or accessing sensitive data. They can also create new user accounts to maintain persistence.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable from the internet (Network), requires no user interaction, and gives attackers complete confidentiality, integrity, and availability impact. The lack of authentication and the ability to fully control the site make it a critical vulnerability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources