CVE-2026-94268

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended versions prior to 0.9.2.8 Advanced Custom Fields: Extended PRO versions prior to 0.9.2.8

Description The front-end Forms module fails to consistently resolve the target of the update-user action between the authorization stage and the execution stage. This inconsistency allows unauthenticated visitors to bypass protections for administrator accounts, leading to full account takeover and the issuance of a valid session for the site administrator. Successful exploitation requires the site to have two separate front-end form configurations where targets are mapped to values submitted by the visitor.

Recommendations Update Advanced Custom Fields: Extended to version 0.9.2.8 or later. Update Advanced Custom Fields: Extended PRO to version 0.9.2.8 or later.