critical9.8
CVE-2026-14563
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email addres…
Impact
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
Affected products
| Product | Affected versions |
|---|---|
| Advanced-Customized-Prompts WordPress Plugin | through 1.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.