Live › vulnerability › CVE-2026-112312
Go to dashboardThe ACF Extended plugin for WordPress has a missing authorization check, so access control is not enforced on some functionality. The sources do not say exactly which data or actions an attacker can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ACF Extended WordPress plugin at version or older are in the affected range. The sources do not say which features or roles are exposed, so unknown whether the default configuration is vulnerable.
0.9.2.7No product ranges from the sources yet.
wp plugin get acf-extended --field=version0.9.2.70.9.2.7 once the vendor publishes a fixed release; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-112312")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.