ACF Extended CVE-2026-94268

Exploitation requires a specific, non-default deployment: the site must publish two separate front-end form configurations in ACF Extended's Forms module, each using the update-user action, whose targets are mapped to visitor-submitted values. The flaw is that the update-user target is resolved inconsistently between the stage that authorises the request and the stage that executes it, letting an unauthenticated visitor bypass the guard protecting administrator accounts. Limiting factors: both forms must exist and expose visitor-controlled target mapping (reflected in CVSS AC:H); sites that do not use front-end user-update forms, or that do not map targets to visitor input, are not exploitable. No authentication or user interaction is required once that configuration is present (PR:N/UI:N).

This is a genuinely high-impact but conditionally-exploitable flaw, and the signals are coherent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated issue whose AC:H reflects a real, non-default precondition: the attack only works when the site publishes two separate front-end form configurations whose targets are mapped to visitor-submitted values. CISA SSVC reinforces this nuance - Exploitation: none (no observed in-the-wild activity), Automatable: no (the dual-form prerequisite and inconsistent-resolution logic cannot be sprayed broadly), but Technical Impact: total, consistent with full administrator account takeover and an issued valid session. There is no CISA KEV listing and no EPSS score was supplied, so widespread opportunistic exploitation cannot be inferred from the data. The vuln.today priority label is 'this_week' (not act_now/emergency), which aligns with: severe outcome if the vulnerable configuration exists, but gated behind a specific deployment pattern rather than default-config mass exploitation. Net: a real priority for the subset of sites running ACF Extended's front-end Forms with the described update-user mapping, and lower practical risk for the majority that do not expose that configuration.

On a WordPress site running ACF Extended with two front-end forms whose update-user targets are driven by visitor-submitted values, an unauthenticated visitor submits a request crafted so the target account resolved during authorization differs from the one acted upon during execution, bypassing the guard that protects administrator accounts. The attacker thereby updates the administrator account and is issued a valid authenticated session for it, achieving full site takeover. No public exploit code is identified at time of analysis; the issue was reported by WPScan.