CVE-2026-14566: WordPress Advanced Customized Prompts Auth Bypass

CVE-2026-14566 Overview

CVE-2026-14566 affects the Advanced Customized Prompts WordPress plugin through version 1.0.1. The plugin fails to perform capability, ownership, or nonce checks before updating WooCommerce order item metadata. Any authenticated user, including a low-privilege subscriber, can tamper with custom metadata belonging to other customers' orders. The flaw maps to CWE-639: Authorization Bypass Through User-Controlled Key, a class of Insecure Direct Object Reference (IDOR) vulnerability.

Critical Impact

Authenticated attackers with subscriber-level access can modify WooCommerce order item metadata for arbitrary orders, breaking customer data integrity and enabling business logic abuse.

Affected Products

• Advanced Customized Prompts WordPress plugin (advanced-customized-prompts)
• All versions through 1.0.1
• WooCommerce-integrated WordPress sites using this plugin

Discovery Timeline

• 2026-09-11 - CVE-2026-14566 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-14566

Vulnerability Analysis

The Advanced Customized Prompts plugin exposes an endpoint that updates WooCommerce order item metadata based on request parameters. The handler accepts an order identifier from the request but never verifies whether the requesting user owns the order or holds the edit_shop_order capability. It also omits nonce validation, removing the standard WordPress request-integrity check.

Because any authenticated session satisfies the endpoint's implicit access requirement, a subscriber account, the lowest privileged WordPress role, can invoke the update path. The attacker supplies an arbitrary order ID and metadata payload, and the plugin writes the values into the target order's item metadata.

The impact is limited to integrity of order metadata. Confidentiality and availability remain unaffected, which aligns with the medium severity rating. However, tampered order metadata can influence downstream fulfillment logic, coupons, custom pricing fields, and printed order details.

Root Cause

The root cause is missing authorization enforcement on a state-changing WooCommerce action. The plugin trusts the supplied order ID without checking ownership, capability, or a valid nonce, violating WordPress security guidance for privileged operations.

Attack Vector

Exploitation requires only a valid authenticated session over the network. An attacker registers or uses an existing subscriber account, then issues a crafted request to the vulnerable plugin endpoint with a target order ID and modified metadata values. No user interaction from the victim is required.

See the WPScan Vulnerability Report for additional technical detail. No public proof-of-concept exploit code has been published, and no realCodeExamples are available for this advisory.

Detection Methods for CVE-2026-14566

Indicators of Compromise

• Requests to admin-ajax.php or REST endpoints registered by the advanced-customized-prompts plugin originating from subscriber-level user sessions.
• Unexpected modifications to woocommerce_order_itemmeta records where the modifying user is not the order owner or a shop manager.
• WooCommerce order audit entries showing metadata changes without corresponding admin-side activity.

Detection Strategies

• Correlate WordPress user role with the target order's _customer_user value; flag mismatches where a non-privileged user updates another user's order.
• Alert on POST requests to plugin action handlers that lack a valid _wpnonce parameter.
• Monitor for enumeration patterns where a single authenticated session touches many sequential order IDs in a short window.

Monitoring Recommendations

• Enable WooCommerce order change logging or an audit plugin to capture metadata write events with user attribution.
• Ship WordPress and web server access logs to a centralized analytics platform for role-versus-resource correlation.
• Review new subscriber account registrations for burst patterns that may indicate preparation for exploitation.

How to Mitigate CVE-2026-14566

Immediate Actions Required

• Deactivate the Advanced Customized Prompts plugin on any site running version 1.0.1 or earlier until a patched release is verified.
• Restrict new user registration to trusted flows and disable open subscriber signup where feasible.
• Audit recent WooCommerce order item metadata changes for unauthorized modifications and restore known-good values.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry or the WPScan Vulnerability Report. Monitor the plugin's WordPress.org listing and the WPScan advisory for a patched release, and upgrade immediately when available.

Workarounds

• Remove the plugin entirely if the customized prompt functionality is not business-critical.
• Deploy a web application firewall rule that blocks unauthenticated and subscriber-role requests to the plugin's metadata update endpoint.
• Enforce capability checks at the reverse proxy or WAF layer by requiring administrative session cookies for order-mutation URLs.

# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate advanced-customized-prompts
wp plugin delete advanced-customized-prompts

# Optional: block the plugin path at the web server (nginx)
location ~* /wp-content/plugins/advanced-customized-prompts/ {
    deny all;
    return 403;
}