ACF Extended lets anyone take over WordPress admin accounts
Two unauthenticated bugs in a 100,000-install add-on for Advanced Custom Fields let a visitor overwrite any account, including the site administrator, through its front-end Forms module.
WPScan disclosed two vulnerabilities on 23 October in Advanced Custom Fields: Extended, an add-on for the base ACF plugin with over 100,000 active installs, also sold as an ACF Extended PRO variant. Both sit in the same place: the update-user action in the plugin’s front-end Forms module.
CVE-2026-94262 lets an unauthenticated visitor overwrite the credentials of any non-administrator account, because the plugin only checks who is allowed to edit the target account when that target happens to be an admin. CVE-2026-94268 goes further: it exploits a mismatch between the stage that authorises the request and the stage that carries it out, bypassing the admin guard entirely so an unauthenticated attacker can take over the site administrator account and be issued a valid session for it. It’s rated 8.1 on CVSS. Both are fixed in version 0.9.2.8.
Why it matters: if a site runs ACF Extended’s front-end Forms module with a visitor-mapped update-user target, which is a supported setup rather than a misconfiguration, an anonymous visitor can become its administrator. Update to 0.9.2.8 now rather than waiting for a routine plugin cycle.
The caveat: exploitation needs that specific Forms configuration in place, and the advisory doesn’t say how common it is in practice. There’s no confirmation yet that either bug is being exploited in the wild.