PT-2026-89775

CVE-2026-14563

Published

2026-09-09

Updated

2026-09-17

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions advanced-customized-prompts versions prior to 1.0.2

Description The plugin fails to verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action. This allows unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts, leading to privilege escalation.

Recommendations Update the plugin to a version newer than 1.0.1.

Exploitability

Exploit

Fix

Impacts

Researchers

0Xbassia

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers