Authentication Bypass in Advanced Custom Fields Plugin for WordPress
CVE-2026-94262
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-94262?
The Advanced Custom Fields: Extended and Extended PRO plugins for WordPress prior to version 0.9.2.8 are susceptible to an authentication bypass error. This vulnerability allows unauthenticated users to exploit the front-end Forms module by modifying user account credentials of non-administrator accounts. The flaw occurs due to the lack of verification for the requester's authorization during the update-user action, which only checks when the targeted account is an administrator. As a result, a malicious actor can gain unauthorized access and take control of user accounts if the site has forms that expose user updates to publicly submitted values.
Affected Version(s)
Advanced Custom Fields: Extended 0.9.2.7 < 0.9.2.8
Advanced Custom Fields: Extended PRO 0.9.2.7 < 0.9.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.