VulnSocial

CVE-2026-94268

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-27: 110-27
Referenced assets1 URL
By indicator
Full discourse1 post
  • George Tasioulis@georgetasioulis

    Imunify360 released WAF rules 8.90 and 8.91. 8.90 is the one to note: • PHP object injection (CVE-2026-115560): new rule WPT-4087 blocks it via the session upload progress field. Same attack path as php2shell, now with its own CVE. • Stored XSS: WordPress core before 7.0.3 (CVE-2026-114570), and two LiteSpeed Cache bugs before 7.9.2 (CVE-2026-113499, CVE-2026-113500). • ACF Extended before 0.9.2.8: three takeover/overwrite bugs (CVE-2026-94267, CVE-2026-94268, CVE-2026-94262). • Zella theme: unauthenticated file upload leading to RCE (CVE-2026-75873). • Plus rules for MailOptin, LearnPress, Mang Board, Divi Plus and a Magento/Adobe Commerce template injection. 8.91 is a cleanup release and fixes a false positive in rule 77350935 that was blocking Magento sessions. https://changelog.imunify.com/waf-rules

    10000118
    817 followersView on X

Explore more

Back to dashboard