Live › vulnerability › CVE-2026-94267
Go to dashboardThe Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 skip capability checks on front-end form post updates. An anonymous visitor can overwrite any post, including the site's field definitions, which can lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
0.9.2.8 is affected0.9.2.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
This page as .md · .json · in your agent: get_signal("CVE-2026-94267")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.