Acpt Premium
Monthly
Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.
Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.