Account takeover in Advanced Custom Fields: Extended front-end forms
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.
Summary
Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.7 before 0.9.2.8 are affected. The front-end Forms update-user action checks authorization only when the target account is an administrator, which is an incorrect authorization flaw (CWE-863). An unauthenticated visitor can overwrite the credentials of any non-administrator account and obtain a session for it, but only if the site publishes a form whose user-update action takes its target from a visitor-submitted value. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Advanced Custom Fields: Extended | 0.9.2.7 to before 0.9.2.8 | 0.9.2.8 | Patch available | CNA |
| Unknown | Advanced Custom Fields: Extended PRO | 0.9.2.7 to before 0.9.2.8 | 0.9.2.8 | Patch available | CNA |
- Advanced Custom Fields: Extended VendorUnknown Affected 0.9.2.7 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA
- Advanced Custom Fields: Extended PRO VendorUnknown Affected 0.9.2.7 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA
Remediation
Update Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO to version 0.9.2.8.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Advanced Custom Fields: Extended (Unknown) Fixed in 0.9.2.8
- Fix · CNA Advanced Custom Fields: Extended PRO (Unknown) Fixed in 0.9.2.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO 0.9.2.8
5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2026-79558 Unauthenticated code execution in Advanced Custom Fields: ExtendedPriority MEDIUM 41
- TI-2026-79559 Privilege management flaw in Advanced Custom Fields: Extended pluginsPriority LOW 37
- TI-2026-79557 XSS in Advanced Custom Fields: Extended via shortcode attributesPriority LOW 32
Timeline
- 2026-10-23 Threatist record created from CVE-2026-94262
- 2026-10-23 Alias added: GHSA-8j7c-fxr7-7933
- 2026-10-23 CVSS score added · CISA ADP
- 2026-10-23 Weakness changed · CISA ADP
- 2026-10-23 CISA SSVC decision points changed
References
Sources
- CVE-2026-94262 · CVE Program
- CVE-2026-94262 · NVD
- FIRST EPSS
- GHSA-8j7c-fxr7-7933 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences