EUVD-2026-108070
GHSA-q37g-7cfq-9phh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
ExploitSend request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactDisclose restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the ACF Extended plugin at a version from the earliest affected release through 0.9.2.7. The description attributes the issue to 'Incorrectly Configured Access Control Security Levels,' indicating the exposure may depend on how the plugin's access-control levels are configured; the available sources do not specify the exact endpoint, feature, or configuration state required to trigger it, so this should be confirmed with the Patchstack advisory. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required, and impact is limited to confidentiality (C:H, I:N, A:N) - there is no integrity or availability effect, which bounds realistic risk to unauthorized data disclosure. |
| Impact | The signals point to a moderate, confidentiality-only issue rather than a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a remotely reachable flaw with no privileges or user interaction required and high confidentiality impact but no integrity or availability impact, consistent with CWE-862 Missing Authorization enabling unauthorized data disclosure. There is no CISA KEV listing and no EPSS score in the input, so widespread or automated exploitation is not demonstrated; the only reference is a Patchstack vulnerability database entry, which is not verified working exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a prompt-but-not-immediate remediation posture. One caveat to verify: the description's phrase 'Exploiting Incorrectly Configured Access Control Security Levels' hints that exploitability may hinge on how access-control levels are configured, which could make the practical attack narrower than the PR:N vector implies - confirm the exact trigger with Patchstack/vendor. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends requests to a WordPress site running ACF Extended ≤ 0.9.2.7 and reaches functionality that should be access-controlled, retrieving data they should not be able to see. No public exploit is identified at time of analysis, and the precise request needed to trigger the missing authorization is not described in the available sources. The low attack complexity means that, once the request form is known, exploitation would be straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Unauthenticated remote users may be able to read protected data from WordPress sites running ACF Extended through 0.9.2.7 because the plugin does not enforce an authorization check in some access-controlled functionality (CWE-862). The CVSS 3.1 score is 7.5 with confidentiality-only impact and no integrity or availability effect; the exact endpoint and configuration state required are not described in the available sources. Patchstack reported the issue, no CISA KEV entry is present, no public exploit identified at time of analysis, and vuln.today places it in the this_week priority tier.
RemediationAI
No vendor-released fixed version is identified in the provided data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acf-extended/vulnerability/wordpress-acf-extended-plugin-0-9-2-7-broken-access-control-vulnerability?_s_id=cve to confirm the patched release, then upgrade ACF Extended past 0.9.2.7. If a patched release is not yet available, review and tighten ACF Extended access-control settings on affected sites, restrict public access to the plugin's admin, AJAX, and REST endpoints with a WAF or IP allowlist (which can block legitimate users), and deactivate or remove the plugin where its functionality is not required (with loss of ACF Extended features). Because impact is confidentiality-only, prioritize monitoring for unauthenticated requests to plugin endpoints and for unexpected disclosure of protected data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the ACF Extended plugin for WordPress, identified by CPE cpe:2.3:a:acf_extended:acf_extended:*:*:*:*:*:*:*:* and by the Patchstack WordPress plugin advisory. The root cause is CWE-862 (Missing Authorization), a class in which a resource or action lacks an access-control check rather than having a check that can be bypassed. The source attributes the exposure to 'Exploiting Incorrectly Configured Access Control Security Levels,' but it does not name the endpoint, AJAX action, REST route, or configuration state required, so the trigger is not described in the available sources. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, unauthenticated attack with no user interaction and a confidentiality-only impact; integrity and availability are unaffected.
Know when Acf Extended gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Missing authorization is reachable remotely without credentials or interaction (AV:N/AC:L/PR:N/UI:N), yielding unauthorized data disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
Executive ViewAI
CVE-2026-112312 is a high-severity vulnerability in the WordPress plugin ACF Extended (up to version 0.9.2.7) that allows unauthenticated remote users to read protected data from affected sites. Any organization running this plugin on public-facing WordPress instances is exposed to unauthorized access to potentially sensitive information, which could lead to data breaches and compliance violations. Leadership should prioritize remediation because the lack of authentication and patch availability increases risk, though no active exploitation has been observed.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the ACF Extended plugin, restricting access to vulnerable endpoints via IP allowlisting, deploying WAF rules to block unauthenticated access, and monitoring for unusual data access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Acf Extended
View allStored cross-site scripting in the ACF Extended WordPress plugin, affecting versions through 0.9.2.7, allows script cont
Arbitrary file deletion in ACF Extended through 0.9.2.7 allows a low-privileged authenticated user to use path traversal
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated
Exploit-DB