CVE-2026-94268
UnknownSummary
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not consistently resolve the target of the update-user action between authorization and execution in its front-end Forms module. This allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account, and obtain a valid session. Exploitation requires two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Risk Assessment
An attacker can take full control of the site via the administrator account, resulting in complete compromise. However, it requires a specific form configuration on the site.
Recommendation
Update the Advanced Custom Fields: Extended (and PRO) plugin to version 0.9.2.8 or later. Review front-end form configurations for targets mapped to user-submitted values.
Other vulnerabilities in Advanced Custom Fields: Extended WordPress plugin
See all- CVE-2026-94267Unknown
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 performs no capability check when updating a post through one of its front-end form actions. This allows unauthenticated visitors to overwrite arbitrary posts, including those storing field definitions, leading to arbitrary code execution on the server. Exploitation requires a published form whose post-update action maps both target and content to visitor-submitted values.
- CVE-2026-94264Unknown
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not validate or escape some form shortcode attributes that can take values from the visitor's request and are output without escaping. This allows users with a role as low as contributor to run arbitrary script in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292.
- CVE-2026-94262Unknown
The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only for administrator accounts. This allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires a published form whose user-update action maps its target to a visitor-submitted value.
Original NVD description (English source)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS