CVE-2026-94268 Details
Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
A vulnerability in the Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins, both prior to version 0.9.2.8, allows unauthenticated visitors to bypass protections on administrator accounts. The issue arises because the plugins' front-end Forms module does not consistently resolve the target of the update-user action between the authorization and execution stages. This flaw enables attackers to take over the site administrator's account and gain a valid session. Exploitation requires the site to have two separate front-end form configurations that direct to visitor-submitted values.
Users are advised to update to version 0.9.2.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/eccfab3c-e7cc-4623-9c20-4cd6c32f8422/ | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Advanced Custom Fields: Extended | < 0.9.2.8 |
CPE
Remediation
| |
| Advanced Custom Fields: Extended PRO | < 0.9.2.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |