Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-110305)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. Exploitation requires that an administrator has configured a public [acfe_form] shortcode page with a Term action using a save.name field mapping — a supported and documented configuration.
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-110305
Risk Score
Threat Entry
Updated 2026-10-29
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-10752)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses…
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-10752
Risk Score
Threat Entry
Updated 2026-10-23
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-94267)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-94267
Risk Score
Threat Entry
Updated 2026-10-23
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-94268)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-94268
Risk Score
Threat Entry
Updated 2026-10-23
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-94262)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than…
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-94262
Risk Score
Threat Entry
Updated 2026-10-23
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-94264)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the…
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-94264
Risk Score
Threat Entry
Updated 2026-09-03
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-80467)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-80467
Risk Score
Threat Entry
Updated 2026-09-03
Advanced Custom Fields: Extended - Security Vulnerability (CVE-2026-12526)
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take…
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-12526
Risk Score
Threat Entry
Updated 2026-07-21
Advanced Custom Fields: Extended - Privilege Escalation (CVE-2026-8809)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter — with no authentication or integrity verification — to select a cleanup branch that silently discards all validation errors not prefixed with acfe:. This makes it possible for unauthenticated attackers to suppress both the role allow-list validation error added by acfe_field_user_roles::validate_front_value() and the administrator-role capability guard error added by acfe_module_form_action_user::validate_action(), causing…
PLUGIN
Advanced Custom Fields: Extended
CVE-2026-8809
Risk Score
Threat Entry
Updated 2026-06-17
The Advanced Custom Fields: Extended - Security Vulnerability (CVE-2025-15463)
The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
The Advanced Custom Fields: Extended
CVE-2025-15463
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields: Extended - Privilege Escalation (CVE-2025-14533)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if 'role' is mapped to the custom field.
PLUGIN
Advanced Custom Fields: Extended
CVE-2025-14533
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields: Extended - Remote Code Execution (CVE-2025-13486)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
PLUGIN
Advanced Custom Fields: Extended
CVE-2025-13486
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields: Extended - Cross-Site Scripting (XSS) (CVE-2023-5292)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Advanced Custom Fields: Extended
CVE-2023-5292
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields: Extended - SQL Injection (CVE-2021-24865)
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
PLUGIN
Advanced Custom Fields: Extended
CVE-2021-24865
Risk Score