Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Account Takeover via Update User Form Action
- ID
- WPSEC-2026-1281
- Plugin
- Advanced Custom Fields: Extended (acf-extended)
- Affected
- all versions before 0.9.2.8
- Remediation
- Update to 0.9.2.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Advanced Custom Fields: Extended on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to privilege escalation via account takeover in the form 'Update User' action in all versions up to, and including, 0.9.2.7. This is due to a missing edit_user capability check when the target user is not an administrator, and to the action logging the current session in as the updated user whenever the user login is changed. This makes it possible for unauthenticated attackers to change the email, password or login of non-administrator accounts, such as editors, and take over those accounts. The form must have an Update User action whose target is not the current user, for example the current post author or a user selected in a form field.
References
- https://wpsec.com/vuln/WPSEC-2026-1281/
- https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/
- https://wordpress.org/plugins/acf-extended/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS