CVE-2026-116624

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[ amem local user password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre update value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user id, causing the can edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp update user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem save all fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.