Advanced Custom Fields: Extended: Incorrect authorization in front-end user update
Summary
The Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 do not check whether the requester may edit a user account in the update-user action of the front-end Forms module. The check is only performed when the target account is an administrator, so non-administrator accounts are not protected. An unauthenticated visitor can overwrite the credentials of such an account and obtain a session as that user. Exploitation requires a published form whose user-update action maps the target to a visitor-submitted value instead of the current user.
Affected
- Advanced Custom Fields: Extended before 0.9.2.8 (CNA data: 0.9.2.7 to before 0.9.2.8; older versions unverified)
- Advanced Custom Fields: Extended PRO before 0.9.2.8 (CNA data: 0.9.2.7 to before 0.9.2.8; older versions unverified)
Fixed in
- Upgrade Advanced Custom Fields: Extended to 0.9.2.8 or later
- Upgrade Advanced Custom Fields: Extended PRO to 0.9.2.8 or later
Workaround
- None known.
- Review all front-end forms that update users and confirm that no target user is taken from visitor input. This is a configuration check, not a fix.
Exploitation
- No evidence of active exploitation found.
- CISA KEV: not listed.
- Public proof of concept: unknown.
- CISA SSVC: exploitation none, automatable no, total technical impact.
- EPSS 0.00132 (low).
Our recommendation
- Update both editions to 0.9.2.8 or later.
- Check whether front-end forms update users and whether the target user comes from visitor input.
- Review recent password changes and user-account activity on affected sites.
- Update together with the related same-day CVEs CVE-2026-94267 and CVE-2026-94268.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: Advanced Custom Fields: Extended 0.9.2.7 Account Takeover wpscan.com
- VulDB: CVE-2026-94262 vuldb.com
- Vulners VulnRichment: CVE-2026-94262 vulners.com
- WPScan: CVE-2026-94267 related vulnerability wpscan.com
- VulDB: CVE-2026-94268 related vulnerability vuldb.com
- WPScan plugin page: acf-extended wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:02.
Original description (NVD)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.