CVE-2026-112312
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The ACF Extended WordPress plugin (versions through 0.9.2.7) contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of improperly configured access controls.
Risk Assessment
An attacker may perform actions they are not authorized to perform, potentially leading to unauthorized access to site functionality or data.
Recommendation
Update the ACF Extended plugin to a version later than 0.9.2.7 and review the site's permission configuration.
Other vulnerabilities in ACF Extended
See all- CVE-2026-112313High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended acf-extended allows Stored XSS. This issue affects ACF Extended: from n/a through 0.9.2.7.
- CVE-2026-112311Medium
The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.
- CVE-2026-81284Medium
The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
Original NVD description (English source)
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS