CVE-2026-116624— Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

Quick assessment

Affected

danbilabs Advanced Members for ACF

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"Advanced Members for ACF"插件在所有 1.3.0 及更早版本中存在权限提升漏洞。该漏洞可通过短代码表单提交中的参数触发。漏洞根源在于文件中函数存在 PHP 运算符优先级错误，导致将布尔值而非解析后的用户 ID 赋值给变量。由于 PHP 的松散相等比较机制，这使得授权检查对任何已登录用户均能通过；同时，会将强制转换为整数，从而无条件地针对主管理员账户（用户 ID 为 1）执行操作。因此，拥有订阅者（Subscriber）及以上权限的已认证攻击者，

CVSS 8.8 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

Source: CVE Program / CVE List V5

Vulnerability Description

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()->submission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
danbilabs	Advanced Members for ACF	0 ~ 1.3.0	-

II. Public POCs for CVE-2026-116624

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116624

请登录查看更多情报信息。

Other References for CVE-2026-116624 (7)

https://www.cve.org/CVERecord?id=CVE-2026-116624

IV. Related Vulnerabilities

Same product: Advanced Members for ACF

CVE-2026-3243
Advanced Members for ACF <= 1.2.5 - Authenticated (Subscribe

Same vendor: danbilabs

CVE-2026-3243
Advanced Members for ACF <= 1.2.5 - Authenticated (Subscribe

Same weakness: CWE-269