CVE-2026-94267

Summary

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 lacks a capability check on its front-end form post-update action, allowing unauthenticated users to overwrite arbitrary posts—including internal field definitions—enabling remote code execution via crafted form submissions.

Exploitability

Exploitation requires the site to expose a front-end form where both the target post ID and the submitted content are fully controlled by the user; high attack complexity due to this narrow configuration dependency.

Blast radius

Successful exploitation grants full server compromise (RCE) and potential data exfiltration or site takeover, affecting all users and systems relying on the vulnerable WordPress instance.

Detection

Look for unauthenticated HTTP POST requests to front-end form endpoints (e.g., /wp-admin/admin-ajax.php?action=acf_ext_form_submit) containing both a 'post_id' parameter and arbitrary PHP/HTML content in fields mapped to post content; repeated submissions targeting the same post ID with non-editor-like payloads may indicate exploitation attempts.

Prioritized remediation

Upgrade to Advanced Custom Fields: Extended version 0.9.2.8 or later, or Advanced Custom Fields: Extended PRO version 0.9.2.8 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.