External risk intelligence

ACPT WordPress Plugin Privilege Escalation Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15354

The vulnerability exists in a WordPress plugin used to create forms. While exploitation depends on the presence of a public-facing form, such forms are a standard and intended use case for this plugin, making internet-reachable exposure a common deployment pattern.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the ACPT (Premium) plugin for WordPress, affecting all versions up to 2.0.66. This flaw allows unauthenticated attackers to potentially take over any user account, including administrators, by overwriting email addresses and passwords through public forms. While exploitation requires a specific configuration, the potential for unauthorized account access is significant.

Unauthenticated users can take over any WordPress account.
Critical control of user accounts, including administrators.
Confirm relevance and potential exposure of public forms.

Attack Path

How an attacker could exploit the issue

An attacker can gain administrative access to a WordPress site by exploiting a flaw in the ACPT (Premium) plugin. This is possible if the site has a public ACPT form that allows anonymous submissions. The attacker can then submit a form to change any user's email and password, including an administrator's, thereby taking over the account.

Requires a public form.
Unauthenticated submissions trigger it.
Leads to account takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could take over any user account, including administrators, by submitting a form. This is possible because the plugin does not properly check if the form submission is authorized before changing a user's email and password. This could occur when a public ACPT user form is configured to allow anonymous submissions.

User accounts and credentials.
Unauthenticated form submissions.
Account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this privilege escalation vulnerability in the ACPT (Premium) WordPress plugin. The first practical step is to identify all WordPress instances using the plugin, determine if public ACPT forms are enabled and reachable externally, and then confirm the accountable owner for each instance to plan risk-based remediation.

Identify plugin usage and public forms.
Verify external reachability and business criticality.
Plan remediation based on risk and ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ACPT (Premium) plugin?

ACPT (Premium) is a WordPress plugin designed to help site administrators create and manage custom content types, fields, and front-end forms. It is commonly used to build interactive features, such as user profile updates or data entry forms, directly on a website's public-facing pages.

What is the weakness class for CVE-2026-15354?

This vulnerability is classified as Improper Privilege Management (CWE-269). In simple terms, the plugin fails to verify the identity of the person submitting a form. Because the software does not check permissions, it inadvertently trusts anonymous users to update sensitive account details, such as passwords or email addresses, that should only be controlled by the actual account owner.

When is CVE-2026-15354 triggered?

The flaw is triggered when an unauthenticated person submits data through an ACPT form that allows anonymous entries. It does not occur if the form is restricted to logged-in users or if the plugin is installed but not actively configured to accept public submissions. If an ACPT form is not live on the site, the underlying vulnerable function remains idle.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' risk because ACPT is frequently used to create internet-facing forms. If your WordPress site hosts any public-facing ACPT forms that allow anonymous submissions, the plugin's integration with your site's user database makes it a potential target for unauthorized account takeovers.

How do I respond to this vulnerability?

Start by performing an inventory of all WordPress sites to identify where the ACPT plugin is installed. For each instance, check if public, anonymous-submission forms are enabled. Once identified, consult the plugin developer's official channels to obtain the latest secure version and apply the update to restrict unauthorized access to user account settings.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.