Advanced Custom Fields: Extended: Privilege escalation to administrator in Front-End Forms
Summary
The WordPress plugins Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO before 0.9.2.8 do not consistently check the target of the update-user action in the Front-End Forms module. An unauthenticated visitor can bypass the protection of administrator accounts, take over the site administrator account and receive a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Affected
- Advanced Custom Fields: Extended (acf-extended) 0.9.2.7 to before 0.9.2.8
- Advanced Custom Fields: Extended PRO (acf-extended-pro) 0.9.2.7 to before 0.9.2.8
- Older versions: Unknown.
Fixed in
- Version 0.9.2.8 or later for both the free and PRO plugin.
Workaround
- No vendor-documented workaround.
- If patching is not possible immediately, temporarily disable front-end forms with user-update actions or forms where the target user comes from visitor input (recommendation, not from the vendor).
Exploitation
- No confirmed in-the-wild exploitation known.
- No public proof of concept known for this CVE.
- Not listed in CISA KEV according to aggregators; not checked directly.
- VulDB statements on exploitation are inconsistent and not confirmed.
Our recommendation
- Update Advanced Custom Fields: Extended and PRO to version 0.9.2.8 or later as soon as possible on all WordPress sites that use front-end forms.
- Check for unexpected administrator accounts, recent password or email changes and active administrator sessions.
- Review front-end forms that create or update users.
- Also patch sibling issues fixed in the same release (CVE-2026-94262, CVE-2026-94267).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory CVE-2026-94268 wpscan.com
- VulDB 425578 vuldb.com
- ACF Extended GitHub repository github.com
- WPScan plugin page acf-extended wpscan.com
- INCIBE-CERT early warning CVE-2026-94268 www.incibe.es
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:02.
Original description (NVD)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.