{"id":"CVE-2026-94262","kind":"vulnerability","aliases":["CVE-2026-94262"],"related":[],"title":"WordPress ACF Extended plugin lets visitors take over non-admin accounts","description":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.","summary":"The Advanced Custom Fields: Extended plugin and its PRO version before 0.9.2.8 skip the authorization check when a front-end form updates a user that is not an administrator. An unauthenticated visitor can overwrite that account's credentials and get a session as that user.","severity":"high","cvss":8.1,"epss":0.00132,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["default-config","no-front-end-user-forms"],"how_to_check":"- Check the installed version of Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO in the WordPress plugins screen or `wp plugin list`\n- Look for front-end forms whose user-update action takes its target user from submitted data rather than the current user\n- unknown","fix":"- Update Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO to `0.9.2.8` or later\n- Rotate passwords and sessions for non-administrator accounts if a vulnerable form was public before the update\n- unknown","status":"open","published_at":"2026-10-23T06:17:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:05:46+00:00","updated_at":"2026-10-25T03:05:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:05:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO to `0.9.2.8` or later\n- Rotate passwords and sessions for non-administrator accounts if a vulnerable form was public before the update\n- unknown","reach":"internet","title":"WordPress ACF Extended plugin lets visitors take over non-admin accounts","impact":"high","summary":"The Advanced Custom Fields: Extended plugin and its PRO version before 0.9.2.8 skip the authorization check when a front-end form updates a user that is not an administrator. An unauthenticated visitor can overwrite that account's credentials and get a session as that user.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over any non-administrator WordPress account","analyst_note":"","how_to_check":"- Check the installed version of Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO in the WordPress plugins screen or `wp plugin list`\n- Look for front-end forms whose user-update action takes its target user from submitted data rather than the current user\n- unknown","needs_analyst":false,"not_affected_if":["default-config","no-front-end-user-forms"],"who_is_affected":"Sites running Advanced Custom Fields: Extended or its PRO version before 0.9.2.8 that publish a front-end form whose user-update action maps the target user to a visitor-submitted value. Sites without such a form, or where the target is always the current user, are not exploitable through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3474,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-94262':15A,18A '0.9.2.8':38B,81C,90C 'account':12A,63B,104C,125C,140C,149C 'acf':2A 'action':110C,162C 'admin':11A 'administr':56B,128C,139C 'advanc':28B,74C,82C 'allow':131C 'author':41B 'authoris':98C 'check':42B,120C 'credenti':65B,142C 'current':177C 'custom':29B,75C,83C 'cve':13A,16A 'default':176C 'edit':100C 'end':47B,115C 'exploit':150C 'extend':3A,31B,77C,85C 'field':30B,76C,84C 'form':48B,116C,157C 'front':46B,114C 'front-end':45B,113C 'get':67B 'hold':126C 'host':22B 'let':5A 'map':163C 'modul':117C 'non':10A,138C 'non-admin':9A 'non-administr':137C 'obtain':144C 'overwrit':61B,135C 'packag':19B 'perform':118C 'plugin':4A,26B,32B,79C,88C 'pro':35B,86C 'publish':155C 'rather':172C 'request':96C 'requir':151C 'role':129C 'self':21B 'self-host':20B 'session':69B,146C 'site':153C 'skip':39B 'submit':170C 'take':7A 'target':102C,124C,165C 'unauthent':58B,132C 'updat':49B,108C,161C 'update-us':107C 'user':51B,72B,103C,109C,160C,178C 'user-upd':159C 'valu':171C 'verifi':93C 'version':36B 'visitor':6A,59B,133C,169C 'visitor-submit':168C 'whose':158C 'wordpress':1A,23B,25B,78C,87C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running Advanced Custom Fields: Extended or its PRO version before 0.9.2.8 that publish a front-end form whose user-update action maps the target user to a visitor-submitted value. Sites without such a form, or where the target is always the current user, are not exploitable through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94262","severity":null,"published_at":"2026-10-23T06:17:08+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94262","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94262","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}