CVE-2026-12526

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended WordPress plugin versions prior to 0.9.2.7

Description The front-end Forms module fails to verify if the requester is authorized to edit a targeted user account during the update-user action. The plugin only performs capability checks when the submitted role is administrator or super admin. If a publicly accessible front-end form is configured to target an administrator account and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite the administrator's password to take over the account. By default, the action targets the submitting user, meaning exploitation requires the form to be specifically configured to target another account.

Recommendations Update Advanced Custom Fields: Extended WordPress plugin to version 0.9.2.7 or later.