CVE-2026-15354

ACPT (Premium), a WordPress plugin for building custom post types and front-end forms, contains a privilege escalation flaw in all versions up to and including 2.0.66, caused by missing authorization checks in the submit() function. Because unauthenticated form submissions can control the target user ID passed to wp_update_user(), any visitor able to reach a public ACPT user form that allows anonymous submissions can supply an arbitrary user ID. An attacker can thereby overwrite the email address and password of any WordPress user, including an administrator, and take over the account. Only sites running the affected premium plugin and exposing a public, anonymous-permitted ACPT user form are vulnerable. No public proof-of-concept or confirmed exploitation is known; EPSS is 0.3% (22nd percentile) and the issue is not in CISA's KEV.

What to do: Update ACPT Premium to the latest patched release (anything above 2.0.66) as soon as one is available. Until patched, restrict or remove public ACPT user forms that permit anonymous submissions, or place them behind authentication. Also review administrator (and other) accounts for unexpected changes to email addresses or passwords, which would indicate exploitation.