CVE-2026-12526

Advanced Custom Fields: Extended (ACF Extended), a WordPress plugin, before version 0.9.2.7 fails to verify that a requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module, only checking a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator account (a fixed target or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password. An attacker who does this gains control of an administrator account, which typically means full administrative access to the WordPress site. Only sites running a vulnerable version with the Forms module configured in this specific way are affected; the default behavior, which updates the submitting user's own account, is not exploitable. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS currently estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Update Advanced Custom Fields: Extended to version 0.9.2.7 or later. As an interim mitigation, audit public front-end forms built with the plugin's Forms module: ensure the update-user action does not target accounts other than the submitter (especially administrators) and remove password fields mapped to visitor-submitted data, or restrict access to such forms. Additionally, check administrator accounts for unexpected password changes and watch for suspicious logins.