WordPress Plugin Vulnerabilities

Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

Description

The plugin does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.

Proof of Concept

Affects Plugins

Plugin icon
advanced-customized-prompts
No known fix

References

CVE
CVE-2026-14566

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (Medium)

Miscellaneous

Original Researcher
0xBassia
Submitter
0xBassia
Submitter website
https://github.com/0xBassia
Submitter twitter
MohamedBassia
Verified
Yes
WPVDB ID
01094477-a9ad-41d9-9acd-f6ed37e6e605

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2025-01-10
Title
Unlimited Theme Addon For Elementor and WooCommerce < 1.2.3 - Authenticated (Contributor+) Post Disclosure
Published
2022-11-12
Title
Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR
Published
2024-04-24
Title
SP Project & Document Manager <= 4.71 - Data Update via IDOR
Published
2025-05-08
Title
WPBookit < 1.0.3 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover
Published
2026-06-02
Title
Simple Shopping Cart < 5.3.0 - Unauthenticated Insecure Direct Object Reference