CVE-2026-94267

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended versions prior to 0.9.2.8 Advanced Custom Fields: Extended PRO versions prior to 0.9.2.8

Description Insufficient capability checks during post updates via front-end form actions allow unauthenticated visitors to overwrite arbitrary posts. This includes posts used to store site field definitions, which can lead to arbitrary code execution on the server. This issue occurs when a site publishes a form where the post-update action maps both the target and content to values submitted by the visitor.

Recommendations Update Advanced Custom Fields: Extended to version 0.9.2.8 or later. Update Advanced Custom Fields: Extended PRO to version 0.9.2.8 or later.