The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 and Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 allow unauthenticated visitors to bypass guards protecting administrator accounts and take over the site administrator's account. This is possible due to inconsistent resolution of the target of the update-user action in its front-end Forms module between authorizat [truncated]
ReviewAdvanced Custom Fields: ExtendedCVE published 2026-10-23
CVE-2026-94267 debrief based on CVE Program and NIST NVD records. The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins before version 0.9.2.8 do not perform capability checks when updating posts through front-end form actions. This allows unauthenticated visitors to overwrite arbitrary posts, including those storing field definitions, leading to arbitrary code ex [truncated]
ReviewAdvanced Custom Fields: ExtendedCVE published 2026-10-23
The Advanced Custom Fields: Extended WordPress plugin is vulnerable to cross-site scripting (XSS) attacks. This issue arises from the plugin's failure to properly validate and escape certain form shortcode attributes, which can be manipulated by users with contributor-level access or higher. These attributes can be crafted to inject malicious scripts, potentially leading to unauthorized actions or data br [truncated]
ReviewAdvanced Custom Fields: ExtendedCVE published 2026-10-23
CVE-2026-94262 debrief: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 and Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 do not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, allowing unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a [truncated]
