CVE-2026-116624

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre_update_value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user_id, causing the _can_edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp_update_user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem_save_all_fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.