Advanced Custom Fields: Extended: Unauthenticated RCE via front-end post update
Summary
The WordPress plugin Advanced Custom Fields: Extended (Basic and PRO editions) before 0.9.2.8 does not check capabilities when a front-end form post-update action runs. Unauthenticated visitors can overwrite arbitrary posts, including those storing the site's field definitions, which can lead to arbitrary code execution on the server. Exploitation requires a published form whose post-update action takes both its target and its content from visitor-submitted values.
Affected
- Advanced Custom Fields: Extended (acf-extended) before 0.9.2.8
- Advanced Custom Fields: Extended PRO (acf-extended-pro) before 0.9.2.8
Fixed in
- Fixed in 0.9.2.8 (both editions)
Workaround
- No vendor-published workaround.
- Until patched, remove or disable front-end forms that update posts and take target and content from visitor input, if they are not needed.
Exploitation
- CISA KEV: not listed according to a third-party snapshot; not directly verified.
- Public proof of concept: none found in the research.
- Status unknown; the CVE is about three weeks old.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Advanced Custom Fields: Extended and the PRO edition to 0.9.2.8 or later on every site.
- Check the plugin version on all WordPress sites, including PRO installations.
- Review front-end forms that perform post updates.
- Check for unexpected changes to posts or field definitions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- ACF Extended changelog www.acf-extended.com
- WordPress.org plugin page wordpress.org
- VulDB CVE-2026-94267 vuldb.com
- Vulners VulnRichment CVE-2026-94267 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:03.
Original description (NVD)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.