Read the docs
TI-2026-79558 Aliases CVE-2026-94267GHSA-69cf-82p8-9425

Unauthenticated code execution in Advanced Custom Fields: Extended

Priority MEDIUM 41CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

Advanced Custom Fields: Extended before 0.9.2.8 and Advanced Custom Fields: Extended PRO before 0.9.2.8 do not check capabilities when a front-end form action updates a post. An unauthenticated visitor can overwrite arbitrary posts, including those storing the site's field definitions, which leads to code execution on the server (CWE-94). Exploitation requires a published form whose post-update action takes both its target and its content from visitor input. An exploit link appears in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced Custom Fields: Extended (Unknown): 0.9.2.8Advanced Custom Fields: Extended PRO (Unknown): 0.9.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced Custom Fields: Extendedbefore 0.9.2.80.9.2.8Patch availableCNA
UnknownAdvanced Custom Fields: Extended PRObefore 0.9.2.80.9.2.8Patch availableCNA
  • Advanced Custom Fields: Extended VendorUnknown Affected before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA
  • Advanced Custom Fields: Extended PRO VendorUnknown Affected before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA

Remediation

Update Advanced Custom Fields: Extended to 0.9.2.8 and Advanced Custom Fields: Extended PRO to 0.9.2.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Advanced Custom Fields: Extended (Unknown) Fixed in 0.9.2.8
  • Fix · CNA Advanced Custom Fields: Extended PRO (Unknown) Fixed in 0.9.2.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO 0.9.2.8

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79559 Privilege management flaw in Advanced Custom Fields: Extended pluginsPriority LOW 37
    • TI-2026-79556 Account takeover in Advanced Custom Fields: Extended front-end formsPriority LOW 37
    • TI-2026-79557 XSS in Advanced Custom Fields: Extended via shortcode attributesPriority LOW 32
    Show all 5 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-94267
  2. 2026-10-23 Alias added: GHSA-69cf-82p8-9425
  3. 2026-10-23 CVSS score added · CISA ADP
  4. 2026-10-23 Weakness changed · CISA ADP
  5. 2026-10-23 CISA SSVC decision points changed
  6. 2026-10-23 Priority changed: LOW → MEDIUM

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences