Privilege Escalation Vulnerability in Advanced Members for ACF Plugin by WordPress

CVE-2026-116624

What is CVE-2026-116624?

The Advanced Members for ACF plugin for WordPress suffers from a privilege escalation vulnerability due to a PHP operator-precedence bug in the pre_update_value function. This flaw allows authenticated users, with a minimum access level of Subscriber, to overwrite the password of the primary administrator account (user ID 1) by submitting the acf[_amem_local_user_password] parameter in the [advanced-members-account-password] shortcode. The vulnerability is exacerbated by an inadequate exclusion mechanism that fails to block unauthorized modifications, enabling attackers to gain full administrative control over the site.

References