Post Update Vulnerability in Advanced Custom Fields: Extended Plugin for WordPress
CVE-2026-94267
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-94267?
The Advanced Custom Fields: Extended WordPress plugin lacks capability checks during post updates via front-end form actions. This oversight allows unauthenticated users to overwrite existing posts, including critical field definition storage, which risks arbitrary code execution on the server. To exploit this vulnerability, a website must publish a form that improperly maps user-submitted values to both the target post and its content.
Affected Version(s)
Advanced Custom Fields: Extended 0 < 0.9.2.8
Advanced Custom Fields: Extended PRO 0 < 0.9.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.