VulnSocial

CVE-2026-94262

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-27: 110-27
Referenced assets1 URL
By indicator
Full discourse1 post
  • George Tasioulis@georgetasioulis

    Imunify360 released WAF rules 8.90 and 8.91. 8.90 is the one to note: • PHP object injection (CVE-2026-115560): new rule WPT-4087 blocks it via the session upload progress field. Same attack path as php2shell, now with its own CVE. • Stored XSS: WordPress core before 7.0.3 (CVE-2026-114570), and two LiteSpeed Cache bugs before 7.9.2 (CVE-2026-113499, CVE-2026-113500). • ACF Extended before 0.9.2.8: three takeover/overwrite bugs (CVE-2026-94267, CVE-2026-94268, CVE-2026-94262). • Zella theme: unauthenticated file upload leading to RCE (CVE-2026-75873). • Plus rules for MailOptin, LearnPress, Mang Board, Divi Plus and a Magento/Adobe Commerce template injection. 8.91 is a cleanup release and fixes a false positive in rule 77350935 that was blocking Magento sessions. https://changelog.imunify.com/waf-rules

    10000118
    817 followersView on X

Explore more

Back to dashboard