Advanced Customized Prompts CVE-2026-14566

The Advanced Customized Prompts plugin must be installed and active alongside WooCommerce on the WordPress site. The attacker must hold at least subscriber-level WordPress authentication (confirmed by CVSS PR:L); fully unauthenticated exploitation is not possible. No non-default configuration is required beyond plugin activation-the vulnerable code path is exercised via the plugin's standard metadata-update functionality. Exploitation is constrained to WordPress environments with both this plugin and WooCommerce active, and requires the attacker to possess or obtain a registered user account on the target site.

The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) correctly reflects a moderate integrity-only impact requiring low-privilege authentication. No CISA KEV listing exists, confirming no verified mass exploitation; however, WPScan's published POC means any subscriber-level account can trivially exercise this flaw without specialized tooling. The absence of a confidentiality or availability component keeps the raw CVSS low, but the business impact of corrupted order metadata can exceed what I:L implies-manipulated fulfillment fields can cause incorrect shipments, customer disputes, or downstream integration failures. Real-world risk is bounded by the plugin's small deployment footprint, but any WooCommerce operator using it-whether a large retailer or a mid-sized municipal procurement shop in mielec running a public-facing store-should treat remediation as immediate, particularly because subscriber-level accounts are routinely available on e-commerce sites that allow customer registration. No EPSS data was provided; given the plugin's niche nature, probabilistic exploitation risk is likely low in aggregate but concentrated among the small population of affected sites.

An attacker registers as a subscriber on a WooCommerce site running the vulnerable plugin, then submits crafted AJAX requests specifying arbitrary order IDs and attacker-chosen metadata key-value pairs. Because the plugin applies the update without any ownership or capability check, the attacker can overwrite fields such as delivery addresses, product customization options, or integration-specific flags for any order in the store. WPScan's published POC makes this straightforward to replicate without reverse-engineering effort.