CVE-2026-12526: CWE-287 Improper Authentication in Advanced Custom Fields: Extended

The Advanced Custom Fields: Extended WordPress plugin versions prior to 0.9.2.7 contain an improper authentication vulnerability (CWE-287) in the front-end Forms module. Specifically, the update-user action does not verify that the requester is authorized to edit the targeted user account unless the submitted role is administrator or super_admin. If a publicly accessible front-end form targets an existing administrator account and maps the password field to user input, an unauthenticated attacker can overwrite the administrator's password and take control of the account. The default form behavior targets the submitting user, so exploitation requires the form to be configured to target a different user account.

Successful exploitation allows an unauthenticated attacker to reset the password of an administrator account, resulting in full account takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site, as the attacker gains administrative privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review and restrict front-end form configurations to ensure they do not target other user accounts, especially administrator accounts. Avoid exposing publicly reachable forms that allow user updates without proper authorization checks.