CVE-2026-14566 advanced-customized-prompts CVE debrief

Who should care

Defenders responsible for WordPress installations using the advanced-customized-prompts plugin, especially those with subscriber-level user accounts, should assess exposure and verify if their systems are vulnerable to this tampering issue.

Why it matters

This vulnerability allows authenticated users to tamper with custom metadata of orders, potentially leading to data integrity issues and unauthorized modifications. Defenders responsible for WordPress installations using the advanced-customized-prompts plugin should assess exposure and verify if their systems are vulnerable.

• Authenticated users can tamper with custom metadata of orders belonging to other customers.
• The vulnerability allows for potential data integrity issues and unauthorized modifications.

Technical summary

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers. This vulnerability can lead to potential data integrity issues and unauthorized modifications. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the affected plugin version.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the affected plugin version.

Recommended defensive actions

• Verify if the advanced-customized-prompts plugin version 1.0.1 or earlier is installed and update to a patched version if available.
• Restrict access to sensitive order metadata and monitor for suspicious activity.
• Implement additional security measures to prevent tampering with custom metadata.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description and WPScan reference identify the affected component as the 'advanced-customized-prompts' WordPress plugin (through 1.0.1). The NVD entry is currently Deferred. Defenders should verify the presence of this plugin in their environment and confirm if the version is 1.0.1 or earlier. They should also review WooCommerce order item metadata for any suspicious changes and monitor system logs for potential tampering attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.