CVE-2026-94262— Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
Quick assessment
Affected
Unknown Advanced Custom Fields: Extended
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 0.9.2.8 版本之前，"Advanced Custom Fields: Extended"WordPress 插件以及"Advanced Custom Fields: Extended PRO"WordPress 插件存在安全漏洞。这两个插件在其前端表单模块的“更新用户”（update-user）操作中，未验证请求者是否有权编辑目标用户账户；该权限检查仅在目标账户拥有管理员角色时才会执行。这导致未认证的访问者能够覆盖任何非管理员账户的凭据，并获取该账户的会话。 要利用此漏洞，目标站点必须发布一个表单，该表单
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94262
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Advanced Custom Fields: Extended | 0.9.2.7 ~ 0.9.2.8 | - |
|
| Unknown | Advanced Custom Fields: Extended PRO | 0.9.2.7 ~ 0.9.2.8 | - |
|
II. Public POCs for CVE-2026-94262
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94262
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-23 · 22 CVEs total
| CVE-2026-94263 | 4.8 MEDIUM | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode E |
| CVE-2026-111965 | 4.3 MEDIUM | Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass |
| CVE-2026-110537 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via | |
| CVE-2026-110510 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and P | |
| CVE-2026-109935 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API | |
| CVE-2026-109933 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes | |
| CVE-2026-109934 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API | |
| CVE-2026-109936 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter | |
| CVE-2026-111737 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists | |
| CVE-2026-111738 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option | |
| CVE-2026-111966 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute | |
| CVE-2026-111982 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vi | |
| CVE-2026-113472 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload | |
| CVE-2026-113501 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal | |
| CVE-2026-113500 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization | |
| CVE-2026-113499 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting | |
| CVE-2026-112230 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter | |
| CVE-2026-112219 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved D | |
| CVE-2026-94267 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update | |
| CVE-2026-94264 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode A |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Advanced Custom Fields: Extended
-
CVE-2026-94263
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthe -
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated A -
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contrib -
CVE-2026-94267
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated -
CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthe
Same vendor: Unknown
-
CVE-2026-94263
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthe -
CVE-2026-111965
Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCH -
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated A -
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contrib -
CVE-2026-94267
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated
V. Comments for CVE-2026-94262
No comments yet