ACF Extended CVE-2026-94262

Exploitation requires the target site to publish a front-end ACF Extended Forms user-update action whose target user is mapped to a visitor-submitted value rather than the default current user; without such a form the flaw is not reachable. When present, exploitation is unauthenticated (PR:N) and needs no user interaction. It is limited to non-administrator accounts - the plugin performs its authorization check only when the target holds an administrator role, so admin accounts are protected. The dependence on this specific, non-default form configuration is the primary factor limiting real-world exploitation and underlies the AC:H rating.

The signals are mixed and lean toward a serious-but-conditional issue rather than an active emergency. CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) reflects a network-reachable, unauthenticated flaw whose high attack complexity (AC:H) is explained directly by the evidence: exploitation only works when a site publishes a front-end Forms user-update action that maps its target to a visitor-submitted value instead of the default current user - a non-default configuration, not an attacker-controlled race or timing condition. SSVC reinforces caution over panic: Exploitation=none and Automatable=no, but Technical Impact=total, matching the full non-administrator account takeover described. CWE-863 (broken authorization) is the correct mechanism - the plugin performs the authorization check only when the target holds an administrator role, leaving all non-admin accounts unprotected. No EPSS score, no CISA KEV listing, and no verified exploit code are present in the input, so there is no evidence of widespread or active exploitation; the vuln.today priority is 'this_week', consistent with prompt remediation but not emergency. Net: a genuine high-severity authorization/account-takeover bug that is real and worth patching this week, gated by a specific form configuration that not every deployment will have.

A WordPress site using ACF Extended publishes a front-end form whose user-update action takes the target user from a visitor-submitted field. An unauthenticated attacker submits that form pointing at another user's (non-administrator) account, overwriting its credentials and receiving an authenticated session for that account. No public exploit is identified in the available data, and administrator accounts are protected by the plugin's role check.