CVE-2026-15354

Name of the Vulnerable Software and Affected Versions ACPT (Premium) plugin for WordPress versions prior to 2.0.67

Description An issue exists where missing authorization in the submit() function allows unauthenticated form submissions to control the target user ID before the wp update user() function is called. This enables unauthenticated attackers to overwrite the email address and password of any WordPress user, including administrators, leading to full account takeover. Successful exploitation requires a public ACPT user form that permits anonymous submissions. The vulnerability involves the acpt form post id variable.

Recommendations Update the ACPT (Premium) plugin for WordPress to version 2.0.67 or later.