CVE-2026-12526 Advanced Custom Fields CVE debrief

Who should care

Defenders of WordPress sites using the Advanced Custom Fields: Extended plugin should assess exposure of their publicly reachable front-end forms and ensure proper authorization for user updates.

Why it matters

Defenders of WordPress sites using the Advanced Custom Fields: Extended plugin should assess exposure of their publicly reachable front-end forms and ensure proper authorization for user updates to prevent unauthenticated visitors from overwriting administrator passwords and taking over accounts.

• Unauthenticated visitors can overwrite administrator passwords
• Account takeover is possible for administrators targeted by the user-update action
• Verification of form configurations and authorization is necessary
• Remediation priority is high for sites with publicly reachable front-end forms

Technical summary

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The vulnerability allows for account takeover via password reset, and defenders should assess the

Defensive priority

Defenders should prioritize verifying exposure of publicly reachable front-end forms and ensuring proper authorization for user updates.

Recommended defensive actions

• Verify exposure of publicly reachable front-end forms
• Ensure proper authorization for user updates
• Review form configurations for targeting administrator accounts
• Update the Advanced Custom Fields: Extended plugin to version 0.9.2.7 or later
• Perform vulnerability scanning to identify exposed sites
• Implement additional monitoring for suspicious user update activity
• Review and update incident response plans for potential account takeovers

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.1 and HIGH severity. WPScan vulnerability entry explicitly identifies the affected WordPress plugin by name.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.