{"id":"CVE-2026-112312","kind":"vulnerability","aliases":["CVE-2026-112312"],"related":[],"title":"WordPress ACF Extended: missing authorization check through version 0.9.2.7","description":"Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.","summary":"The ACF Extended plugin for WordPress has a missing authorization check, so access control is not enforced on some functionality. The sources do not say exactly which data or actions an attacker can reach.","severity":"high","cvss":7.5,"epss":0.00232,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the ACF Extended plugin (acf-extended) in the WordPress admin under Plugins, or with `wp plugin get acf-extended --field=version`\n- Compare the result against the affected range, which is up to and including `0.9.2.7`","fix":"- Update ACF Extended (acf-extended) to a version later than `0.9.2.7` once the vendor publishes a fixed release; the sources do not name the fixed version\n- Until then, unknown whether a workaround exists","status":"open","published_at":"2026-10-22T09:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:15:14+00:00","updated_at":"2026-10-25T03:15:14+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T03:15:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update ACF Extended (acf-extended) to a version later than `0.9.2.7` once the vendor publishes a fixed release; the sources do not name the fixed version\n- Until then, unknown whether a workaround exists","reach":"internet","title":"WordPress ACF Extended: missing authorization check through version 0.9.2.7","impact":"medium","summary":"The ACF Extended plugin for WordPress has a missing authorization check, so access control is not enforced on some functionality. The sources do not say exactly which data or actions an attacker can reach.","category":"runtime","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to plugin-protected functionality on the site","analyst_note":"Find the vendor advisory or the Wordfence/NVD detail to learn which endpoint lacks the check, the required role, and the fixed version.","how_to_check":"- Check the installed version of the ACF Extended plugin (acf-extended) in the WordPress admin under Plugins, or with `wp plugin get acf-extended --field=version`\n- Compare the result against the affected range, which is up to and including `0.9.2.7`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ACF Extended WordPress plugin at version `0.9.2.7` or older are in the affected range. The sources do not say which features or roles are exposed, so unknown whether the default configuration is vulnerable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3345,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112312':12A,15A '-2026':11A,14A '0.9.2.7':9A,84C 'access':36B,73C 'acf':2A,25B,62C,64C,67C,79C 'acf-extend':66C 'action':53B 'affect':78C 'allow':69C 'attack':55B 'author':5A,33B,59C 'check':6A,34B 'configur':72C 'control':37B,74C 'cve':10A,13A 'data':51B 'enforc':40B 'exact':49B 'exploit':70C 'extend':3A,26B,63C,65C,68C,80C 'function':43B 'host':19B 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':4A,32B,58C 'n/a':82C 'plugin':23B,27B 'reach':57B 'runtim':16B 'say':48B 'secur':75C 'self':18B 'self-host':17B 'sourc':45B 'version':8A 'vulner':60C 'wordpress':1A,20B,22B,29B 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the ACF Extended WordPress plugin at version `0.9.2.7` or older are in the affected range. The sources do not say which features or roles are exposed, so unknown whether the default configuration is vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112312","severity":null,"published_at":"2026-10-22T09:17:14+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112312","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112312","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}