EUVD-2026-69871
GHSA-qq65-x2qx-772f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the required non-default form configuration targeting another account; PR:N because the attacker is unauthenticated and exploits a public web form.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.
AnalysisAI
Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following non-default conditions to be present simultaneously: (1) the WordPress site exposes a publicly reachable front-end form using the ACF Extended Forms module with the update-user action; (2) that form is configured to target an administrator or super_admin account - either hardcoded or via a visitor-supplied field mapping - rather than the default behavior of targeting the submitting user's own account; and (3) the form includes a password field mapped to visitor-controlled input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score with AC:H correctly captures that exploitation is not universal - it requires a specific non-default form configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Advanced Custom Fields: Extended to version 0.9.2.7 or later, which corrects the authorization check in the update-user action of the Forms module. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, update Advanced Custom Fields: Extended to version 0.9.2.7 on all WordPress installations and verify the patch is active in plugin settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Advanced Custom Fields
View allThe Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 all
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows una
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced C
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 all
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outpu
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9
Arbitrary file deletion in the Novarain/Tassos Framework system plugin (plg_system_nrframework) and the suite of Tassos.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au
Arbitrary shortcode execution in the Advanced Custom Fields: Extended WordPress plugin (all versions through 0.9.2.3) en
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro ve
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today