Advanced Custom Fields: Extended CVE-2026-8809

Exploitation requires the target WordPress site to publicly expose an ACFE (Advanced Custom Fields: Extended) frontend Form configured with a Create User action that maps a role field - this is a non-default plugin configuration that the site owner must explicitly build. No authentication or user interaction is needed (CVSS PR:N/UI:N), and the attack is delivered as a single crafted HTTP POST containing an attacker-controlled _acf_post_id parameter and an 'administrator' role value to the form-handling endpoint. Limiting factors: sites that have ACFE installed but do not publish such a form, or that map only non-privileged roles without exposing the role field to the submitter, are not exploitable via this path; the vulnerability is bounded to ACFE versions up to and including 0.9.2.5 on the hwk-fr CPE.

All available signals point to a high-priority issue: the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact, and successful exploitation yields administrator access - effectively full site compromise. The vulnerability is not currently listed in CISA KEV and no EPSS score was supplied in the input, so probability-of-exploitation telemetry is unknown; however, WordPress plugin admin-creation flaws have historically been automated quickly once disclosed by Wordfence. The most important caveat is that exploitation is gated by a non-default condition - the site must expose a public ACFE frontend form configured with a Create User action that maps a role field - so the population of immediately exploitable sites is a subset of all installs, which tempers the otherwise straightforward CVSS-9.8 read. No public exploit identified at time of analysis based on the references provided.

An unauthenticated attacker identifies a WordPress site running ACFE <= 0.9.2.5 that exposes a public frontend Form with a Create User action mapping a role field (for example, a 'Become a contributor' signup page). The attacker submits the form with a crafted _acf_post_id POST parameter and a role value of 'administrator'; the validation-bypass causes the role allow-list and admin-capability errors to be discarded, and wp_insert_user() provisions a new administrator account that the attacker uses to install a malicious plugin and achieve full site takeover.