CVE-2026-94267 Advanced Custom Fields: Extended CVE debrief

Who should care

Defenders managing WordPress environments with Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO plugins should assess exposure and prioritize updates to prevent potential RCE attacks.

Why it matters

CVE-2026-94267 allows unauthenticated RCE via front-end post update action in Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO plugins. Defenders should verify exposure, prioritize updates, and monitor for suspicious activity to prevent potential code execution and post overwrites.

• Potential for unauthenticated code execution on the server
• Ability for attackers to overwrite arbitrary posts, including field definitions
• Possible disruption of WordPress environment operations
• Need for verification of plugin versions and exposure

Technical summary

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 and Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 do not perform capability checks when updating posts through front-end form actions. This allows unauthenticated visitors to overwrite arbitrary posts, including those storing field definitions, leading to arbitrary code execution on the server. The vulnerability is particularly concerning due to its unauthenticated nature and the potential for attackers to overwrite field definitions, which could lead to a complete compromise of the WordPress environment. Defenders should prioritize verifying exposure of these plugins in their WordPress environments, especially if 0.9.2.

Defensive priority

Defenders should prioritize verifying exposure of Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO plugins in their WordPress environments, especially if versions less than 0.9.2.8 are in use.

Recommended defensive actions

• Verify and update Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO plugins to version 0.9.2.8 or later
• Review WordPress environments for exposure, especially if versions less than 0.9.2.8 are in use
• Monitor for suspicious post update activity
• Perform a thorough review of the WordPress environment to identify any potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO plugins, allowing unauthenticated RCE via front-end post update action.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.