{"id":"CVE-2026-94267","published":"2026-10-23T06:17:08.200","lastModified":"2026-10-23T14:20:57.920","description":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9c8f45c1-cd85-4a9c-be77-88801d8143ce/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 lacks a capability check on its front-end form post-update action, allowing unauthenticated users to overwrite arbitrary posts—including internal field definitions—enabling remote code execution via crafted form submissions.","exploitability":"Exploitation requires the site to expose a front-end form where both the target post ID and the submitted content are fully controlled by the user; high attack complexity due to this narrow configuration dependency.","blast_radius":"Successful exploitation grants full server compromise (RCE) and potential data exfiltration or site takeover, affecting all users and systems relying on the vulnerable WordPress instance.","remediation":"Upgrade to Advanced Custom Fields: Extended version 0.9.2.8 or later, or Advanced Custom Fields: Extended PRO version 0.9.2.8 or later.","detection":"Look for unauthenticated HTTP POST requests to front-end form endpoints (e.g., /wp-admin/admin-ajax.php?action=acf_ext_form_submit) containing both a 'post_id' parameter and arbitrary PHP/HTML content in fields mapped to post content; repeated submissions targeting the same post ID with non-editor-like payloads may indicate exploitation attempts.","tags":["rce","auth-bypass","web","wordpress","acf","insecure-direct-object-reference"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:54:36.465Z"}}