External risk intelligence

Advanced-Customized-Prompts WordPress Plugin Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-14563

This vulnerability affects a WordPress plugin, which is typically used to extend the functionality of public-facing web applications. Because these sites are frequently exposed to the internet to serve content or interact with users, the vulnerable plugin code is commonly reachable via public web traffic.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in a WordPress plugin allows unauthorized access to any user account, including administrative ones, without needing credentials. Attackers could potentially log in as any user or create new accounts, impacting the integrity and availability of WordPress sites.

Unauthenticated users can access any account.
Affects public-facing websites and user data.
Confirm plugin relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can gain unauthorized access to a WordPress site by exploiting a flaw in the advanced-customized-prompts plugin. This vulnerability allows anyone on the internet to log in as any user, including administrators, or create new accounts without needing any credentials. The attack is possible because the plugin improperly handles authentication checks for user sessions.

No prior access needed.
An unauthenticated action triggers it.
Allows full account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in a WordPress plugin could allow an unauthenticated attacker to gain administrative access to a WordPress site by impersonating any registered user or creating new accounts. This could occur if the plugin is installed and the affected feature is accessible. The primary risk is unauthorized control over the website and its content.

Website administrative access.
Unauthenticated login to website.
Compromised website integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the advanced-customized-prompts WordPress plugin allows unauthenticated attackers to hijack user sessions or create new accounts. Action will likely fall to the web application or platform team responsible for the WordPress instance, requiring coordination with the security team to assess exposure and plan remediation. The first practical step is to identify all instances of the plugin, confirm internet reachability, and determine business criticality to prioritize response.

WordPress platform and security teams own resolution.
Verify all internet-facing WordPress sites.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the advanced-customized-prompts WordPress plugin?

It is an add-on component used to enhance or customize prompt interactions within a WordPress site. WordPress plugins are modular tools that developers install to extend the core platform's functionality, often providing specialized features for site visitors or administrators.

How does CVE-2026-14563 work?

This vulnerability is an Improper Authentication weakness, classified as CWE-287. It means the software fails to properly verify the identity of a user. In this specific case, the plugin grants an active session to any email address provided without requiring a password, bypassing standard login security.

Do I need to be logged in to trigger this vulnerability?

No. The flaw exists within an unauthenticated action, meaning no prior login, account, or special permissions are required to initiate the attack. Simply sending the correct request to the plugin's endpoint is sufficient to trigger the unauthorized access.

Is my website at risk if it uses this plugin?

Halo Surface Signal indicates that because this plugin is designed for public-facing WordPress sites, it is likely reachable via standard web traffic. If your site is internet-facing, the risk of unauthorized access or account creation is significantly higher.

How should I respond to CVE-2026-14563?

Start by auditing your WordPress environment to identify every instance where this plugin is currently installed or active. Once identified, evaluate the plugin's necessity for your site's operations while coordinating with your security team to plan for removal or updates.

References

wpscan.com/vulnerability/7c7ad196-dff3-485f-9a50-8705bd796fb3/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.