CVE-2026-14563CWE-287

CVE-2026-14563

Critical · published September 11, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-11T11:16Z
References (1)
https://wpscan.com/vulnerability/7c7ad196-dff3-485f-9a50-8705bd796fb3/ · [email protected]
EPSS history
Timeline
  • 12 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 11 SEP 06:00Z
    Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover
    cvelistv5