CVE-2026-94268 Advanced Custom Fields: Extended CVE debrief

Who should care

Defenders responsible for WordPress site security, particularly those using the Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO plugins, should assess exposure and prioritize updates to affected versions.

Why it matters

CVE-2026-94268 allows unauthenticated visitors to bypass guards protecting administrator accounts in Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO plugins, potentially leading to site administrator account compromise. Defenders should prioritize verifying and updating affected plugin versions, restricting access to front-end form configurations, and monitoring for suspicious update-user actions.

• Unauthenticated administrator account takeover
• Potential for site administrator account compromise
• Need for verification and updates to affected plugin versions
• Possible exploitation through front-end form configurations

Technical summary

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 and Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 do not consistently resolve the target of the update-user action in its front-end Forms module between authorization and execution stages. This inconsistency allows unauthenticated visitors to bypass guards protecting administrator accounts and take over the site administrator's account. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.

Defensive priority

Defenders should prioritize verifying and updating affected plugin versions, restricting access to front-end form configurations, and monitoring for suspicious update-user actions.

Recommended defensive actions

• Verify and update affected plugin versions to 0.9.2.8 or later
• Restrict access to front-end form configurations to prevent unauthorized modifications
• Monitor for suspicious update-user actions and implement additional security measures as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential exploitation. However, additional information from vendor sources and exploit testing may be necessary for comprehensive risk assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.