A critical privilege escalation vulnerability in the Mauro Cassani ACPT (Premium) WordPress plugin allows unauthenticated attackers to hijack administrative accounts and compromise the entire site.

This vulnerability is caused by a missing authorization check within the submit() function. It allows unauthenticated users to modify the target user ID during form submission, leading to an unauthorized update of any user's credentials via wp_update_user().

Successful exploitation grants an attacker full administrative control over the WordPress site. This results in complete data exposure, unauthorized modification of site content, potential malware injection, and significant reputational damage. The CVSS score of 9.8 reflects the high risk posed by this unauthenticated, remote exploitability.

Immediate Action: Update the Mauro Cassani ACPT (Premium) plugin to the latest version immediately to resolve the missing authorization flaw.

Proactive Monitoring: Review WordPress access and security logs for suspicious user account modifications or unexpected password reset activity.

Compensating Controls: If an immediate update is not feasible, disable any public-facing ACPT user forms that permit anonymous submissions to prevent exploitation.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to site integrity and security. Administrators must prioritize updating the ACPT (Premium) plugin to a version beyond 2.0.66 to close this authorization gap. Failure to act leaves the environment susceptible to full account takeover by any external actor.