CVE-2026-8809 hwk-fr CVE debrief

Who should care

WordPress site administrators using Advanced Custom Fields: Extended plugin; security teams managing WordPress installations; web application firewall operators; managed WordPress hosting providers

Technical summary

The vulnerability exists in the `after_validate_save_post()` function which processes the `_acf_post_id` POST parameter without authentication checks or integrity verification. When this parameter is manipulated, the function selects a cleanup branch that filters out validation errors lacking the `acfe:` prefix. This bypasses two critical security controls: (1) the role allow-list validation in `acfe_field_user_roles::validate_front_value()` and (2) the administrator-role capability guard in `acfe_module_form_action_user::validate_action()`. With these validations suppressed, `wp_insert_user()` executes using attacker-supplied role parameters, enabling unauthenticated creation of administrator accounts. Exploitation requires a publicly accessible ACFE frontend form configured with a Create User action that includes role field mapping. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network attack vector, low complexity, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

• Immediately update Advanced Custom Fields: Extended plugin to version 0.9.2.6 or later
• Audit all ACFE frontend forms for Create User actions with role field mappings and verify they are not publicly accessible until patched
• Review WordPress user accounts for unauthorized administrator-level accounts created since plugin installation
• Implement Web Application Firewall rules to block suspicious POST requests to ACFE form endpoints containing manipulated _acf_post_id parameters
• Disable public ACFE frontend forms with Create User actions if patching is not immediately feasible
• Monitor WordPress audit logs for unexpected user creation events with administrator privileges

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code analysis. The `after_validate_save_post()` function at hooks.php#L636 processes the `_acf_post_id` parameter without verification. Validation errors from `acfe_field_user_roles::validate_front_value()` and `acfe_module_form_action_user::validate_action()` are suppressed when the cleanup branch is triggered. The `wp_insert_user()` function executes with attacker-controlled role parameters. Patch available in changeset 3551665.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.