{
 "id": "WPSEC-2026-1281",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1281/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1281/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1281/index.md",
 "title": "Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Account Takeover via Update User Form Action",
 "description": "The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to privilege escalation via account takeover in the form 'Update User' action in all versions up to, and including, 0.9.2.7. This is due to a missing edit_user capability check when the target user is not an administrator, and to the action logging the current session in as the updated user whenever the user login is changed. This makes it possible for unauthenticated attackers to change the email, password or login of non-administrator accounts, such as editors, and take over those accounts. The form must have an Update User action whose target is not the current user, for example the current post author or a user selected in a form field.",
 "plugin": {
  "slug": "acf-extended",
  "name": "Advanced Custom Fields: Extended",
  "full_name": "Advanced Custom Fields: Extended",
  "wordpress_org": "https://wordpress.org/plugins/acf-extended/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acf-extended/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acf-extended"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.9.2.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.9.2.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.9.2.8",
 "remediation": "Update to 0.9.2.8 or later.",
 "fix_released": "2026-10-19T13:23:29+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:09.721780+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1281/",
  "https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/",
  "https://wordpress.org/plugins/acf-extended/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acf-extended",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}