CVE-2026-94262 Details
Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
A vulnerability exists in the Advanced Custom Fields: Extended WordPress plugin and the Advanced Custom Fields: Extended PRO WordPress plugin, both prior to version 0.9.2.8. The issue arises because the plugins do not properly verify if a requester is authorized to edit the targeted user account during the update-user action in the front-end Forms module. This lack of verification only applies to non-administrator accounts, enabling unauthenticated visitors to overwrite the credentials of any non-administrator account and gain access to that account's session. Exploitation requires the site to have a form that directs user-update actions to a value submitted by the visitor, rather than the default current user.
Users are advised to update to version 0.9.2.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/3634e73f-df12-4d84-8bf6-c098efa0b191/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Advanced Custom Fields: Extended | < 0.9.2.8 |
CPE
Remediation
| |
| Advanced Custom Fields: Extended PRO | < 0.9.2.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |