hwk-fr CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL hwk-fr CVE published 2026-05-28

CVE-2026-8809

CVE-2026-8809 is a critical privilege escalation vulnerability in the Advanced Custom Fields: Extended (ACFE) WordPress plugin, affecting all versions up to and including 0.9.2.5. The vulnerability stems from improper validation in the `after_validate_save_post()` function, which unconditionally trusts the attacker-controlled `_acf_post_id` POST parameter without authentication or integrity verification. [truncated]

MEDIUM hwk-fr CVE published 2026-05-12

CVE-2025-15463

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.