CVE-2026-94262
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields…
- Risk score
- 56/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the targ…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.9.2.8 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Last activity 23 Oct 2026. Patch Forecast updates every hour.