CVE-2026-116624

Summary

The Advanced Members for ACF WordPress plugin (≤1.3.0) contains a privilege escalation flaw where authenticated users with Subscriber-level access or higher can overwrite the password of the site administrator (user ID 1) due to a PHP operator-precedence bug that incorrectly assigns boolean true instead of a user ID, bypassing authorization checks and targeting the admin account via wp_update_user().

Exploitability

Exploitation requires only a valid authenticated session (any role ≥ Subscriber) and no additional privileges or social engineering; it is trivial to execute once an attacker has basic login access.

Blast radius

Successful exploitation grants full administrative control of the WordPress site to the attacker, enabling complete compromise including data theft, malware deployment, and lateral movement.

Detection

Monitor WordPress debug logs or custom audit logs for unexpected password changes to user ID 1 (admin) by non-administrative users; also watch for POST requests to endpoints handling [advanced-members-account-password] form submissions containing the acf[_amem_local_user_password] parameter from low-privilege accounts.

Prioritized remediation

Upgrade to Advanced Members for ACF version 1.3.1 or later, which resolves the operator-precedence bug and restores proper field exclusion logic in Account::process().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.