What is the CVSS score of CVE-2026-8809?

CVE-2026-8809 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Advanced Custom Fields: Extended are affected by CVE-2026-8809?

The Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9.2.5 contains a critical vulnerability enabling unauthenticated attackers to create administrator accounts and achieve…

How to fix or mitigate CVE-2026-8809?

Within 24 hours: Inventory all WordPress instances running ACFE through version 0.9.2.5; immediately disable the plugin or restrict all public-facing ACFE forms to authenticated users only. Within 7 days: Audit administrator account creation logs from the past 90 days for unauthorized accounts; implement Web Application Firewall rules to block POST requests to ACFE form endpoints; enable detailed admin action logging. Within 30 days: Establish permanent detection rules for unauthorized privilege escalation attempts; maintain heightened monitoring; verify no persistence mechanisms remain from unauthorized accounts; track vendor advisory for patch release.

Advanced Custom Fields: Extended CVE-2026-8809

EUVD-2026-33165 CRITICAL

Improper Privilege Management (CWE-269)

2026-05-28 Wordfence

GHSA-jvvq-c627-79xm

WordPress Privilege Escalation Advanced Custom Fields Wordpress Plugin

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 23:20 vuln.today

CVE Published

May 28, 2026 - 22:27 nvd

CRITICAL 9.8

DescriptionCVE.org

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter - with no authentication or integrity verification - to select a cleanup branch that silently discards all validation errors not prefixed with acfe:. This makes it possible for unauthenticated attackers to suppress both the role allow-list validation error added by acfe_field_user_roles::validate_front_value() and the administrator-role capability guard error added by acfe_module_form_action_user::validate_action(), causing wp_insert_user() to execute with an attacker-supplied administrator role argument and resulting in the creation of a new administrator-level user account. Exploitation requires the target site to expose a public ACFE frontend form configured with a Create User action that maps a role field.

AnalysisAI

Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9.2.5 allows remote attackers to create new administrator-level accounts on vulnerable sites. The flaw stems from the after_validate_save_post() function trusting an attacker-controlled POST parameter to bypass role allow-list and capability validation when a public ACFE frontend form with a Create User action is exposed. With a CVSS 9.8 and no public exploit identified at time of analysis, the vulnerability presents a direct site-takeover path on affected configurations.

Technical ContextAI

Advanced Custom Fields: Extended is a popular WordPress add-on that extends the Advanced Custom Fields (ACF) plugin with additional field types, modules, and frontend form-building capabilities, including a Form module that can perform actions like creating users on submission. The root cause is classified as CWE-269 (Improper Privilege Management): the after_validate_save_post() hook in includes/hooks.php selects an error-cleanup branch based on the unauthenticated _acf_post_id POST parameter, and that branch silently discards every validation error whose key is not prefixed with 'acfe:'. As a result, both the role allow-list error emitted by acfe_field_user_roles::validate_front_value() and the administrator-role capability guard error emitted by acfe_module_form_action_user::validate_action() are dropped before submission, causing wp_insert_user() to proceed with the attacker-supplied role argument. The affected CPE is cpe:2.3:a:hwk-fr:advanced_custom_fields:_extended (vendor hwk-fr), and the upstream code paths involved are visible in the plugins.trac.wordpress.org references for tag 0.9.2.4.

RemediationAI

Upstream fix available (changeset 3551665 in the acf-extended plugin trac, https://plugins.trac.wordpress.org/changeset/3551665/acf-extended); a released patched version beyond 0.9.2.5 is not independently confirmed from the provided data, so administrators should update to the latest available ACFE release that supersedes 0.9.2.5 as soon as it is published and verified against the Wordfence advisory. As an immediate compensating control until patching, unpublish or remove any public-facing ACFE frontend Form that uses the Create User action mapped to a role field, or reconfigure the form to hard-code a non-privileged role server-side and remove the role field mapping - this directly eliminates the exploitable code path at the cost of disabling self-service user registration through that form. Where the form must remain online, restrict access via authentication (place behind a logged-in-only page), a WAF rule blocking submissions containing crafted _acf_post_id values, or IP allow-listing; each of these adds operational friction and a WAF rule alone may be bypassed by parameter variants, so it should be treated as temporary mitigation rather than a fix.