CVE-2026-94268: CWE-269 Improper Privilege Management in Advanced Custom Fields: Extended

CVE-2026-94268 is an improper privilege management vulnerability (CWE-269) in the Advanced Custom Fields: Extended WordPress plugin prior to version 0.9.2.8. The vulnerability arises because the plugin does not consistently resolve the target of the update-user action between the authorization stage and the execution stage in its front-end Forms module. This inconsistency allows unauthenticated attackers to bypass protections on administrator accounts, effectively taking over the site administrator's account and obtaining a valid session. Exploitation requires the presence of two distinct front-end form configurations whose targets are mapped to visitor-submitted values.

An unauthenticated attacker can bypass authorization controls and gain administrator-level access to the affected WordPress site. This results in a full site takeover, including issuance of a valid administrator session, which can lead to complete compromise of the site and its data.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates and apply any available patches promptly once released. Until then, avoid publishing multiple front-end form configurations that map targets to visitor-submitted values, as this is required for exploitation.