Read the docs
TI-2026-79559 Aliases CVE-2026-94268GHSA-5c6h-7vg8-f3f2

Privilege management flaw in Advanced Custom Fields: Extended plugins

Priority LOW 37CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

The Advanced Custom Fields: Extended WordPress plugin from 0.9.2.7 before 0.9.2.8 and Advanced Custom Fields: Extended PRO from 0.9.2.7 before 0.9.2.8 do not resolve the target of the update-user action in the front-end Forms module consistently between authorization and execution. An unauthenticated visitor can bypass the guard protecting administrator accounts, take over the site administrator's account and receive a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values. The flaw is tracked as CWE-269 (Improper Privilege Management).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced Custom Fields: Extended (Unknown): 0.9.2.8Advanced Custom Fields: Extended PRO (Unknown): 0.9.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced Custom Fields: Extended0.9.2.7 to before 0.9.2.80.9.2.8Patch availableCNA
UnknownAdvanced Custom Fields: Extended PRO0.9.2.7 to before 0.9.2.80.9.2.8Patch availableCNA
  • Advanced Custom Fields: Extended VendorUnknown Affected 0.9.2.7 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA
  • Advanced Custom Fields: Extended PRO VendorUnknown Affected 0.9.2.7 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA

Remediation

Update Advanced Custom Fields: Extended to version 0.9.2.8 and Advanced Custom Fields: Extended PRO to version 0.9.2.8. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Advanced Custom Fields: Extended (Unknown) Fixed in 0.9.2.8
  • Fix · CNA Advanced Custom Fields: Extended PRO (Unknown) Fixed in 0.9.2.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO 0.9.2.8

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79558 Unauthenticated code execution in Advanced Custom Fields: ExtendedPriority MEDIUM 41
    • TI-2026-79556 Account takeover in Advanced Custom Fields: Extended front-end formsPriority LOW 37
    • TI-2026-79557 XSS in Advanced Custom Fields: Extended via shortcode attributesPriority LOW 32
    Show all 5 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-94268
  2. 2026-10-23 Alias added: GHSA-5c6h-7vg8-f3f2
  3. 2026-10-23 CVSS score added · CISA ADP
  4. 2026-10-23 Weakness changed · CISA ADP
  5. 2026-10-23 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences