Advanced Members for ACF password form flaw lets subscribers take over admin accounts
Any logged-in member can change the site admin's password here.
Summary
A flaw in the password change form of the Advanced Members for ACF WordPress plugin lets any logged-in Subscriber-level user overwrite the password of the site's primary administrator (user ID 1) and gain full admin access. Versions up to and including 1.3.0 are affected.
Affected when
- Logged-in account with Subscriber-level access or above
- Advanced Members for ACF 1.3.0 or earlier
What to do
Check that the installed version is newer than 1.3.0 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen