ACF Extended CVE-2026-80467

Exploitation requires that the target WordPress site has: (1) the Advanced Custom Fields: Extended plugin installed and running version 0.9.2.2 through pre-0.9.2.7; and (2) at least one front-end user registration form built with ACFE that is publicly accessible to unauthenticated visitors - this form must be published and reachable without authentication. Sites where ACFE is installed but no front-end user registration forms have been created or published are NOT exposed. The CVSS PR:N confirms no prior authentication is required once a registration form endpoint is reachable. Limiting factors: the non-default requirement for an actively deployed ACFE registration form, and the two-stage nature of the attack (register with elevated role, then escalate to administrator), which may trigger anomaly detection in monitored environments.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable, unauthenticated attack with full-triad impact but elevated complexity (AC:H). The AC:H is plausible here because the attack requires the administrator to have deliberately configured and published a front-end user registration form using ACFE - a non-default deployment step. Sites that have not deployed such forms are not exposed. For sites that have deployed them, however, the exploitation path is straightforward and requires no authentication or user interaction, which meaningfully raises real-world risk. The existence of a publicly available PoC (via WPScan) further elevates priority for affected deployments. EPSS data was not provided in the input; given the conditional deployment requirement, broad automated exploitation at scale is less likely than targeted attacks against sites with active ACFE registration forms. No CISA KEV listing was identified, consistent with targeted rather than mass exploitation. Overall: high priority for sites actively using ACFE front-end user forms; lower urgency for sites without them.

An attacker identifies a WordPress site running ACFE with a publicly accessible front-end user registration form. The attacker crafts a registration POST request that includes a role parameter set to 'administrator' (or another privileged role) that was not offered by the form - bypassing both the form's legitimate role dropdown and the plugin's incomplete blocklist. The account is created with elevated privileges, which the attacker then uses to gain full WordPress administrative control, enabling theme/plugin modification, credential harvesting, or web shell deployment. A publicly available PoC via WPScan makes this attack accessible to low-skill threat actors.