WordPress Plugin Allows Unauthenticated User Impersonation

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The advanced-customized-prompts WordPress plugin contains a critical authentication bypass vulnerability (CWE-287) that completely undermines access control mechanisms. By exploiting an unauthenticated action that issues authenticated sessions without password verification, attackers can log in as any registered user—including site administrators—or create arbitrary new accounts. This affects any WordPress installation running the vulnerable plugin version 1.0.1 or earlier, putting administrative access and site integrity at severe risk. The CVSS 9.8 critical rating reflects the ease of exploitation and the complete loss of confidentiality, integrity, and availability an attacker could achieve.

Casky.ai's 283 mapped security skills leverage Claude's extended reasoning to detect the behavioral patterns associated with this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious indicators including: unexpected session creation without corresponding password submissions, account generation tied to unauthenticated API calls, administrator-level access grants from non-admin sources, and abnormal authentication logs showing successful logins for dormant accounts. The platform's skill correlation would surface these attack chains as indicators of CWE-287 violations—specifically the missing authentication check in the session issuance logic—allowing security teams to distinguish between legitimate authentication failures and exploitation attempts targeting this specific plugin flaw.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14563.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14563

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14563. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn