Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Advanced Custom Fields: Extended 0.9.2.7 Clear all filters
TI-2026-55522 CVE-2026-80467 · GHSA-hp9v-f4wf-r363

Improper privilege management in Advanced Custom Fields: Extended

Priority LOW 37

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00373 Published 2026-09-02 Fixed in 0.9.2.7 CWE-269
TI-2026-10749 CVE-2026-12526 · GHSA-qq65-x2qx-772f

Improper authentication in Advanced Custom Fields: Extended

Priority LOW 37

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only che…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00373 Published 2026-09-02 Fixed in 0.9.2.7 CWE-287