medium4.3
CVE-2026-14566
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order ite…
Impact
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
Affected products
| Product | Affected versions |
|---|---|
| Advanced-Customized-Prompts WordPress Plugin | through 1.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.