Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-14563: advanced-customized-prompts plugin lets anyone log in
CVE-2026-14563 · published 1 month ago
Summary
The advanced-customized-prompts plugin for WordPress, up to version 1.0.1, skips password verification when creating a user session. This lets anyone on the internet log in as any existing user, including administrators, or create new accounts. Update or remove the plugin immediately and change passwords for all accounts that use it.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | advanced-customized-prompts | <= 1.0.1 |
Original advisory text
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowi...
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-287Improper Authentication
Timeline
Published11 Sep 2026
Updated12 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta