CVE-2026-94262: CWE-863 Incorrect Authorization in Advanced Custom Fields: Extended

CVE-2026-94262 describes an incorrect authorization vulnerability (CWE-863) in the Advanced Custom Fields: Extended WordPress plugin before version 0.9.2.8. The flaw exists in the update-user action of the front-end Forms module, where the plugin only checks authorization if the targeted account is an administrator. For non-administrator accounts, no authorization check is performed, allowing unauthenticated users to overwrite credentials and obtain sessions for those accounts. Exploitation requires the site to publish a form that allows the user-update action's target to be set by visitor input rather than defaulting to the current user.

An attacker can gain unauthorized access to non-administrator user accounts by overwriting their credentials without authentication. This compromises the affected user accounts' integrity and confidentiality. Administrator accounts are not affected by this vulnerability due to the authorization check in place for those roles. There are no known exploits in the wild at this time.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, avoid publishing front-end forms that allow the user-update action's target to be set by visitor-submitted values. Restrict or disable the vulnerable functionality to prevent unauthorized user credential updates.