Privilege Escalation Vulnerability in Advanced Custom Fields: Extended Plugin for WordPress

CVE-2026-8809

What is CVE-2026-8809?

The Advanced Custom Fields: Extended plugin for WordPress is susceptible to a privilege escalation vulnerability due to a validation bypass in the after_validate_save_post() function. This function improperly trusts the attacker-controlled _acf_post_id POST parameter, which allows unauthorized users to bypass crucial validation checks. As a result, attackers can suppress validation errors related to user role permissions, enabling them to create new administrator-level accounts without proper authentication. This exploit is particularly critical when a public ACFE frontend form is configured with a Create User action that maps a role field, putting many WordPress sites at risk.

References