ACF Extended CVE-2026-12526

Exploitation requires all three of the following non-default conditions to be present simultaneously: (1) the WordPress site exposes a publicly reachable front-end form using the ACF Extended Forms module with the update-user action; (2) that form is configured to target an administrator or super_admin account - either hardcoded or via a visitor-supplied field mapping - rather than the default behavior of targeting the submitting user's own account; and (3) the form includes a password field mapped to visitor-controlled input. The default configuration (form targets the submitting user) is not exploitable. Exploitation is blocked by: absence of public user-update forms, no password field exposed on such forms, the form targeting non-admin accounts only, or any access control on the page hosting the form.

The CVSS 8.1 score with AC:H correctly captures that exploitation is not universal - it requires a specific non-default form configuration. The provided CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is consistent with the described attack: network-reachable, no privileges, no user interaction, but constrained by configuration prerequisites. The publicly available WPScan proof-of-concept significantly lowers the exploitation barrier for attackers who can identify a misconfigured site. No CISA KEV listing is present at time of analysis, so confirmed active exploitation cannot be claimed. EPSS data was not provided in the source intelligence. The real-world risk concentrates on sites that have extended ACF Extended forms to handle user account management for scenarios such as user profile update pages - a non-trivial but not uncommon deployment pattern for sites with custom user workflows.

An attacker finds a WordPress site with a publicly accessible page hosting an ACF Extended front-end form configured to update a fixed administrator account and expose a password field. The attacker submits the form with a chosen password; the plugin processes the update without checking authorization, overwrites the administrator's password, and the attacker logs in to the WordPress dashboard. A WPScan proof-of-concept is publicly available, requiring minimal technical skill to execute against a misconfigured site.