Vulnerability · Published Sep 2, 2026 · Assigned by WPScan

CVE-2026-80467Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

High 8.1

In plain English

A high-severity privilege mismanagement in Advanced Custom Fields: Extended from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 68.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Advanced Custom Fields: Extended	0.9.2.2 – before 0.9.2.7

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/929f243b-2f1c-4eca-88bc-03b1a86270ed/ exploit, vdb-entry, technical-description