Published October 23, 2026. Based on public CVE records available on that date; details may change.

Four CVEs published on October 23, 2026 affect Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO before version 0.9.2.8. The most serious can let unauthenticated visitors take over accounts or run code on the server, but only on sites whose front-end forms are configured in specific ways. Update both editions to 0.9.2.8, then review your forms, users, and field definitions.

What happened

All four issues sit in the plugin's Forms module, which lets a site publish front-end forms that create or update posts and users. WPScan published the records as the CVE Numbering Authority. None of them includes a CVSS score, and the records reviewed for this article do not mention exploitation in the wild.

CVE-2026-94267: code execution through a post update form

The record says one of the front-end form actions performs no capability check when it updates a post. An unauthenticated visitor can overwrite arbitrary posts, including the posts where the site stores its own field definitions, which the record says leads to arbitrary code execution on the server. Exploitation requires a published form whose post update action maps both its target and its content to values the visitor submits. The record lists every version before 0.9.2.8 as affected.

CVE-2026-94268: administrator account takeover

The update user action resolves its target one way when it checks permission and another way when it carries out the change. According to the record, an unauthenticated visitor can bypass the guard that protects administrator accounts, take over the site administrator's account, and receive a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets map to visitor-submitted values. The record lists version 0.9.2.7 as affected.

CVE-2026-94262: non-administrator account takeover

The update user action checks whether the requester may edit the target account only when that account holds an administrator role. Any other account, such as an editor, author, or customer, can have its credentials overwritten by an unauthenticated visitor, who then gets a session for it. Exploitation requires a published form whose user update action takes its target from a visitor-submitted value instead of the default current user. The record lists version 0.9.2.7 as affected.

CVE-2026-94264: cross-site scripting via form shortcode attributes

Some attributes of the form shortcode are not validated or escaped. A user with contributor access or higher can point them at values from the visitor's own request, so script runs in the browser of anyone who opens a crafted link or page, including a logged-in administrator. The record calls this an incomplete fix for CVE-2023-5292 and lists versions from 0.8.9.4 up to, but not including, 0.9.2.8.

Who is affected

Sites running the free or PRO plugin before 0.9.2.8 are affected, with exposure depending on configuration:

  • CVE-2026-94267: all versions before 0.9.2.8, with a post update form mapped to visitor input.
  • CVE-2026-94268 and CVE-2026-94262: version 0.9.2.7, with user update forms mapped to visitor input.
  • CVE-2026-94264: 0.8.9.4 up to 0.9.2.8, on sites where untrusted people hold contributor access or higher.

The free plugin had 100,000+ active installations on WordPress.org as of October 23, 2026, and 0.9.2.8 is its current release there. PRO is sold separately by the vendor and is not on WordPress.org. The vendor's changelog dates 0.9.2.8 to October 19, 2026 and lists form changes such as a shortcode argument allow list and new capability checks for post and user actions.

How to check your site

Check the version, then the forms.

  1. In Plugins, find Advanced Custom Fields: Extended or its PRO edition and note the version.
  2. With WP-CLI, wp plugin list --name=acf-extended shows the free plugin. For PRO, run wp plugin list and find it by name, since the folder name can differ.
  3. Open the plugin's Forms screen and list every form that uses a post or user update action. Note any form whose target post or user comes from a submitted value rather than the current post or current user.
  4. Search your pages for the [acfe_form] shortcode, and check whether contributors or authors can add it to their own content.

If you rely on forms that update users, review accounts:

  • wp user list --role=administrator --fields=ID,user_login,user_email,user_registered lists every administrator.
  • wp user session list USERNAME shows active sessions for one account.

Also review field definitions. ACF stores field groups and fields as posts of type acf-field-group and acf-field. Running wp post list --post_type=acf-field-group,acf-field --orderby=modified --order=DESC --fields=ID,post_type,post_title,post_modified shows recent changes. Edits your team did not make are a reason for a full investigation. Our guides to finding hidden WordPress admin users and finding a WordPress backdoor cover the next steps.

What to do now

Update first. For the free plugin, use Dashboard, Updates or wp plugin update acf-extended. For PRO, download 0.9.2.8 from your vendor account or use the licensed updater, then confirm the version on the Plugins screen.

If you cannot update right away, unpublish or remove forms that update posts or users based on submitted values until you can. Then:

  1. Take a backup of files and database before cleaning anything, to preserve evidence.
  2. Remove administrator and editor accounts nobody can account for, and reset passwords for the rest.
  3. Log out all sessions with wp user session destroy USERNAME --all for any account you suspect.
  4. Remove contributor or author access from people who no longer need it, which also narrows the XSS issue. The WordPress hardening checklist covers role cleanup.

If you find changed field groups, unknown administrators, or unexpected files, assume the server may have been accessed. Rotate hosting, SFTP, and database credentials along with WordPress passwords. wp core verify-checksums flags modified core files but does not check plugins, themes, or the database.

When to get help

Get help if your site published user or post update forms on an affected version and you see account or field changes you cannot explain. Our WordPress malware removal service handles suspected compromises, and a security audit can review your form configuration and user roles.

Sources