CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
| Vendor | unknown |
| Product | advanced custom fields: extended |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown advanced custom fields: extended
Be the first to know when new high vulnerabilities affecting unknown advanced custom fields: extended are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Advanced Custom Fields: Extended
0.9.2.2 < 0.9.2.7
References
Credits
Jakub Herman WPScan