CVE-2026-81284
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
Risk Assessment
The risk includes privilege escalation, potentially leading to unauthorized changes in plugin configuration or data.
Recommendation
Update ACF Extended to the latest version and implement proper access controls.
Other vulnerabilities in ACF Extended
See all- CVE-2026-112313High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended acf-extended allows Stored XSS. This issue affects ACF Extended: from n/a through 0.9.2.7.
- CVE-2026-112312High
The ACF Extended WordPress plugin (versions through 0.9.2.7) contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of improperly configured access controls.
- CVE-2026-112311Medium
The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.
Original NVD description (English source)
Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS