Vulnerability · Published Oct 23, 2026 · Assigned by WPScan
CVE-2026-94267Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
Critical 9.0
In plain English
A critical-severity code injection in Advanced Custom Fields: Extended from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced Custom Fields: Extended | 0 – before 0.9.2.8 |
| Unknown | Advanced Custom Fields: Extended PRO | 0 – before 0.9.2.8 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/9c8f45c1-cd85-4a9c-be77-88801d8143ce/ exploit, vdb-entry, technical-description