A critical authentication bypass vulnerability in the Advanced Customized Prompts WordPress plugin allows unauthenticated attackers to gain full administrative access.

The plugin fails to verify passwords when processing authentication requests for a supplied email address. This allows an unauthenticated attacker to manipulate the login flow to authenticate as any user, including administrators, or to create unauthorized administrative accounts.

The CVSS score of 9.8 reflects the extreme risk of total site takeover. An attacker exploiting this flaw can gain complete control over the WordPress instance, leading to unauthorized data access, modification of site content, and potential injection of malicious scripts into the environment.

Immediate Action: Update the Advanced Customized Prompts plugin to the latest version. If an update is not available, deactivate and remove the plugin immediately until a secure version is released.

Proactive Monitoring: Review WordPress user account logs for unexpected new administrative accounts or anomalous login activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block suspicious authentication requests directed at the plugin endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists per the WPScan vulnerability database reference.

This vulnerability is highly critical and provides a direct path to administrative compromise. Organizations using this plugin must take immediate action to mitigate the risk, either by updating to a patched version or by removing the vulnerable software from their production environment.