CVE-2026-14563 Overview
CVE-2026-14563 is an authentication bypass vulnerability in the Advanced Customized Prompts WordPress plugin through version 1.0.1. The plugin exposes an unauthenticated action that issues an authenticated session for a supplied email address without verifying the associated password. Attackers can log in as any registered user, including administrators, or create arbitrary new accounts. The flaw maps to [CWE-287: Improper Authentication] and requires no privileges, no user interaction, and is exploitable over the network.
Critical Impact
Unauthenticated attackers can gain full administrator access to affected WordPress sites, leading to complete site takeover.
Affected Products
- Advanced Customized Prompts WordPress plugin, versions up to and including 1.0.1
- WordPress installations with the plugin activated
- All hosting environments running the vulnerable plugin
Discovery Timeline
- 2026-09-11 - CVE-2026-14563 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-14563
Vulnerability Analysis
The Advanced Customized Prompts plugin registers an unauthenticated action handler that accepts an email address and issues a valid authenticated session for the matching user account. The handler omits the password verification step that WordPress normally enforces during login. This bypass turns a routine login flow into an unauthenticated impersonation primitive.
An attacker who knows or guesses an administrator email address can obtain an administrator session. Common administrator emails such as admin@example.com or addresses exposed on public author pages make discovery trivial. The same endpoint also permits creation of arbitrary new accounts, giving attackers a persistence mechanism even after credentials are rotated.
Once authenticated as an administrator, attackers can install malicious plugins, modify themes, inject PHP code, exfiltrate database contents, and pivot to other systems that trust the site.
Root Cause
The root cause is missing authentication logic in an action registered to unauthenticated hooks such as wp_ajax_nopriv_* or a public REST route. The handler calls WordPress session-issuing functions like wp_set_auth_cookie() or wp_set_current_user() based solely on an attacker-supplied email parameter. No password, nonce, or capability check gates the session issuance.
Attack Vector
Exploitation requires only a single HTTP request to the vulnerable endpoint containing the target email address. The request produces authentication cookies that grant full session access to the impersonated account. Refer to the WPScan Vulnerability Report for technical details on the vulnerable endpoint.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose to avoid distributing exploitation payloads.
Detection Methods for CVE-2026-14563
Indicators of Compromise
- Unexpected WordPress user accounts created without a corresponding registration workflow entry
- Administrator logins from unfamiliar IP addresses without preceding wp-login.php POST requests
- Access log entries targeting plugin-specific admin-ajax.php actions or REST routes from the Advanced Customized Prompts plugin
- New or modified plugin, theme, or wp-config.php files following anomalous authentication events
Detection Strategies
- Alert on WordPress user_register and wp_login events that lack an associated authenticate filter chain
- Monitor for HTTP requests to admin-ajax.php or REST endpoints containing plugin-specific action names paired with an email parameter
- Correlate administrator session issuance with the absence of a prior password submission in access logs
Monitoring Recommendations
- Enable WordPress audit logging for authentication, user creation, and role changes
- Forward web server access logs to a centralized analytics platform for pattern analysis
- Baseline legitimate administrator source IPs and alert on deviations
How to Mitigate CVE-2026-14563
Immediate Actions Required
- Deactivate and remove the Advanced Customized Prompts plugin until a patched version is available
- Audit all WordPress user accounts and remove any unrecognized administrator or editor accounts
- Rotate passwords for all privileged accounts and invalidate active sessions
- Review recent plugin, theme, and file modifications for unauthorized changes
Patch Information
No fixed version was identified in the available advisory data at the time of publication. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for update announcements. Apply the vendor patch immediately once released.
Workarounds
- Block requests to the plugin's vulnerable AJAX or REST endpoints at the web application firewall
- Restrict access to /wp-admin/ and admin-ajax.php by source IP where feasible
- Enforce multi-factor authentication on all WordPress accounts to limit impact of session hijacking
- Remove the plugin directory from wp-content/plugins/ to eliminate the attack surface
# Example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate advanced-customized-prompts
wp plugin delete advanced-customized-prompts
# Audit for unauthorized administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.