ACF Extended CVE-2026-94267

The site must publish at least one ACF Extended front-end form whose post-update action maps BOTH its target post and its content to visitor-submitted values; this specific, non-default form configuration is the hard prerequisite, and without it the vulnerability is not exploitable. When that form exists, no authentication is required (PR:N) and no user interaction is needed (UI:N) - an unauthenticated visitor can overwrite arbitrary posts, including the posts storing ACF field definitions, leading to code execution. The limiting factor is therefore not authentication but deployment: exposure is confined to vulnerable versions (both ACF Extended and ACF Extended PRO below 0.9.2.8) that also expose such a visitor-writable post-update form, which is why CVSS rates attack complexity high and SSVC marks the issue not automatable.

Signals here point in genuinely different directions and must be weighed together. The CVSS 3.1 base score is 9.0 (Critical) with an unauthenticated network vector (AV:N/PR:N/UI:N), scope change (S:C) and total CIA impact (C:H/I:H/A:H), reflecting that a successful attack yields arbitrary code execution on the server. However, the vector itself carries AC:H, and the description explains why: exploitation is not against a default install but depends on the site operator having published a specific kind of front-end form. CISA's SSVC framework reinforces this tension - Technical Impact is rated total, yet Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (the per-site configuration prerequisite defeats mass, indiscriminate scanning). No EPSS probability was supplied in the input, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. Set against that, the vuln.today priority is act_now, which is driven by the combination of an unauthenticated vector and total technical impact rather than by any observed exploitation. Bottom line: this is a legitimately high-priority patch for any site running a vulnerable version AND publishing the specific form configuration described, but it is not a wormable, spray-and-pray internet-wide threat - the gating configuration requirement means real-world exposure is narrower than the 9.0 score alone implies. The EPSS score is absent rather than low, so prioritization should lean on the act_now label and the config-dependent exposure, not on a probability signal that was not provided.

A WordPress site runs ACF Extended (free or PRO) below 0.9.2.8 and publishes a front-end form whose post-update action maps both the target post and its content to visitor-submitted values. An unauthenticated visitor submits that form with crafted values that overwrite the post storing the site's ACF field definitions, injecting PHP that is subsequently executed by the server, yielding remote code execution. No public working exploit is identified in the provided sources; the WPScan reference is an advisory, not verified exploit code.