CVE-2026-94267 Details
Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
A remote code execution vulnerability has been identified in the Advanced Custom Fields: Extended WordPress plugin and the Advanced Custom Fields: Extended PRO WordPress plugin, both prior to version 0.9.2.8. The vulnerability arises because the plugins do not perform capability checks when updating posts through certain front-end form actions. This oversight allows unauthenticated users to overwrite arbitrary posts, including those containing the site's field definitions. Such exploitation could lead to arbitrary code execution on the server. To exploit this vulnerability, a form must be published that maps its post-update action to visitor-submitted values.
Users are advised to update to version 0.9.2.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/9c8f45c1-cd85-4a9c-be77-88801d8143ce/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Advanced Custom Fields: Extended | < 0.9.2.8 |
CPE
Remediation
| |
| Advanced Custom Fields: Extended PRO | < 0.9.2.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |