NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-116624 — WordPress

HIGH

CVE-2026-116624 is a high-severity (CVSS 8.8) Improper Privilege Management vulnerability. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter…

Published
Updated
Affected
—
Patched
—
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-116624.

Description

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre_update_value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user_id, causing the _can_edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp_update_user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem_save_all_fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    The records we use list no fixed release for CVE-2026-116624. Check the upstream advisory for a patched version, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.

Frequently Asked Questions

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => t
O3 Security · Impact-Aware SCA

Is CVE-2026-116624 in your dependencies?

Find it across your dependency tree, including transitive dependencies.

Scan my dependencies How O3 SCA works