---
id: "CVE-2026-94262"
kind: "vulnerability"
aliases: ["CVE-2026-94262"]
title: "WordPress ACF Extended plugin lets visitors take over non-admin accounts"
severity: "high"
cvss: 8.1
epss: 0.00132
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["default-config", "no-front-end-user-forms"]
published_at: "2026-10-23T06:17:08+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:05:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94262", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94262", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WordPress ACF Extended plugin lets visitors take over non-admin accounts

The Advanced Custom Fields: Extended plugin and its PRO version before 0.9.2.8 skip the authorization check when a front-end form updates a user that is not an administrator. An unauthenticated visitor can overwrite that account's credentials and get a session as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO in the WordPress plugins screen or `wp plugin list`
- Look for front-end forms whose user-update action takes its target user from submitted data rather than the current user
- unknown

## Fix

- Update Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO to `0.9.2.8` or later
- Rotate passwords and sessions for non-administrator accounts if a vulnerable form was public before the update
- unknown

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94262
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94262

## From the sources

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_