CVE-2026-94267

LOWCVSS 9.0 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/9c8f45c1-cd85-4a9c-be77-88801d8143ce/

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

NewNormal Security@NewScanTeam1d
NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 23 Oct 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Unpatched plugin version, pulled from the plugin directory — a crafted object runs code on the site, or the database reads back a character at a time (xnau Participants Database CVE-2026-112862, CVE-2026-112860) 🔓 Front-end form that updates posts with no capability check — an anonymous visitor overwrites the posts holding the site's own field definitions (ACF Extended CVE-2026-94267) 🔎 Database access gateway fingerprint — the console fronting every database behind it now gets named in the inventory (Bytebase) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #ObjectInjection #CSO #REDTEAM
0000023
6 followersView on X

Explore more

Back to dashboard