A missing authorization check in the ACPT (Premium) WordPress plugin lets unauthenticated attackers rewrite any user's email and password, administrators included, scoring a CVSS 9.8.
What Is It
CVE-2026-15354 is a privilege escalation flaw (CWE-269) in the ACPT (Premium) plugin for WordPress, published 2026-09-04 and reported by Wordfence. The plugin's submit() function is missing an authorization check, so unauthenticated form submissions can control the target user ID passed to wp_update_user(). An attacker who can reach a public ACPT user form that permits anonymous submissions can therefore overwrite an arbitrary WordPress account's email address and password and take the account over outright.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. That combination means a remote attacker with no foothold can, on an exposed site, escalate straight to administrator. Because password and email are both rewritten, the legitimate owner loses the ordinary account recovery path at the same moment the attacker gains it.
The precondition that matters most is exposure: exploitation via this path requires a publicly reachable ACPT user form that accepts anonymous submissions. Sites running the plugin without such a form are unlikely to be directly exploitable through this specific path, but that should be treated as a reduction in exposure rather than a guarantee; other plugin entry points reaching the same vulnerable function have not been ruled out in the supplied data.
What's Vulnerable
- Vendor: Mauro Cassani
- Product: ACPT (Premium) plugin for WordPress
- Affected versions: all versions up to and including 2.0.66 (default status for other versions: unaffected)
Patch Status
The supplied NVD record lists the ACPT changelog as a reference but does not state a fixed version. There is no entry for CVE-2026-15354 in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed and no KEV-mandated remediation deadline applies; though the absence of a KEV listing reflects what CISA has catalogued, not positive evidence that the flaw is unexploited. Administrators should consult the vendor changelog below for a release beyond 2.0.66 and, in the interim, review whether any public ACPT user forms on the site accept anonymous submissions.
Sources
- NVD, CVE-2026-15354: https://nvd.nist.gov/vuln/detail/CVE-2026-15354
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/abc138f5-0bb7-4ce3-a504-89580021bedb?source=cve
- ACPT Changelog: https://acpt.io/changelog/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog