CVE-2026-80467highCWE-269

CVE-2026-80467: high-severity vulnerability in Advanced Custom Fields: Extended

Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

Published

Follow this CVE+ Monitor Advanced Custom Fields: Extended

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.1epss 0.4%
from disclosure to weapon15 days
Published on NVDSep 2
1st PoC+15d
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Advanced Custom Fields: Extended
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Advanced Custom Fields: Extended

In the same product, most dangerous first.

CVE-2021-24865—Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionEPSS 1.5%CVE-2026-94267CRITICALAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionEPSS 0.4%CVE-2026-12526HIGHAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.4%CVE-2026-94268HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%CVE-2026-94264MEDIUMAdvanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode AttributesEPSS 0.3%CVE-2026-94262HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%