CVE-2026-94267: CWE-94 Improper Control of Generation of Code ('Code Injection') in Advanced Custom Fields: Extended

CVE-2026-94267 is a code injection vulnerability (CWE-94) in the Advanced Custom Fields: Extended WordPress plugin and its PRO version prior to 0.9.2.8. The flaw arises because the plugin does not perform any capability checks when updating posts through certain front-end form actions. An attacker can exploit this by submitting crafted data to overwrite arbitrary posts, including those storing field definitions, which enables arbitrary code execution on the server. Exploitation requires the site to have a published form whose post-update action maps both the target post and content to visitor-submitted values.

Successful exploitation allows unauthenticated attackers to overwrite arbitrary posts and execute arbitrary code on the server hosting the WordPress site. This can lead to full compromise of the affected server and site content.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid publishing front-end forms that map post-update actions to visitor-submitted values without proper capability checks.