Advanced Customized Prompts CVE-2026-14563

Exploitation requires only that the vulnerable Advanced Customized Prompts plugin (≤1.0.1) be installed and active on a network-reachable WordPress site, and that the attacker knows or guesses a valid registered email address (administrator emails are frequently exposed via author archives, REST API /wp-json/wp/v2/users, or page footers); the account-creation path needs no pre-existing email at all. No authentication, no credentials, and no user interaction are needed - the unauthenticated action issues the session directly. Limiting factors are minimal: the primary real-world constraint is the plugin's low deployment prevalence, not any configuration or platform requirement.

This is a genuine high-priority issue, not an inflated CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is internally consistent with the description: the flaw is reachable over the network through an unauthenticated action, requires no user interaction and no special timing, and logging in as an administrator grants full confidentiality, integrity, and availability impact over the site. Publicly available exploit code (WPScan) materially raises real-world risk and lowers the skill bar. No EPSS score or KEV status was provided in the input; absence of a KEV listing is not evidence of safety, but there is no confirmation of active exploitation at this time. The main tempering factor is deployment footprint rather than technical difficulty - the plugin appears obscure, so exploitation is likely opportunistic/targeted rather than mass-scale.

An attacker identifies a WordPress site running the plugin and sends a crafted unauthenticated request to the vulnerable action, supplying the administrator's email address. The server returns a valid authenticated session cookie without any password check, and the attacker browses directly into wp-admin with full privileges; public exploit code from WPScan makes this trivial to reproduce, after which the attacker can install a malicious plugin/theme for code execution.