Unauthorized Access Vulnerability in Advanced Custom Fields Plugin by WordPress
CVE-2026-94268
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-94268?
A vulnerability in the Advanced Custom Fields: Extended and Extended PRO plugins for WordPress could allow unauthenticated users to bypass security measures, potentially enabling them to take control of the site administrator's account. This issue arises from inconsistent handling of update-user actions within the front-end Forms module, creating opportunities for attackers to exploit two separate form configurations that map visitor-submitted values to unauthorized targets. Site administrators are advised to update their plugins to mitigate the risks associated with this vulnerability.
Affected Version(s)
Advanced Custom Fields: Extended 0.9.2.7 < 0.9.2.8
Advanced Custom Fields: Extended PRO 0.9.2.7 < 0.9.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.