Advanced Customized Prompts
Monthly
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.