EUVD-2026-70920
GHSA-5gph-5gjx-7rg9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated request to a public form yields admin account takeover (email/password overwrite), giving full confidentiality, integrity, and availability impact with no interaction.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the submit() function, which allows unauthenticated form submissions to control the target user ID before calling wp_update_user(). This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
Articles & Coverage 1
AnalysisAI
Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must run ACPT (Premium) <= 2.0.66 and must expose a public ACPT user form configured to permit anonymous (unauthenticated) submissions - this is the concrete prerequisite named in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is internally consistent with the description: fully remote, no authentication, no user interaction, and a direct route to administrator takeover - which is why this warrants emergency patching wherever a public ACPT form is exposed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update ACPT (Premium) to the first release above 2.0.66 that contains the authorization fix; consult the vendor changelog at https://acpt.io/changelog/ to confirm the exact patched version, as the provided data does not name a specific fixed release (No vendor-released patch version identified in the input at time of analysis). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable and remove the ACPT (Premium) WordPress plugin version 2.0.66 and all earlier versions from all WordPress installations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today