Three flaws in ACF Extended, update to version 0.9.2.8

Q: How do I check whether my site has ACF Extended forms?

In cPanel's Terminal, wp post list --post_type=acfe-form --post_status=any lists the ACF Extended forms in the database and changes nothing. In wp-admin the same forms are in the ACF menu, under Forms. The ones that need attention are a Post action set to Update post and a User action set to Update user whose Target field is linked to a form field rather than Current Post or Current User.

Q: Will my form stop working after updating to ACF Extended 0.9.2.8?

It might. In version 0.9.2.8 the [acfe_form] shortcode accepts only allowed arguments, and Template Tags are no longer permitted in them. If a form stops working after the update, that may be why, and the fix is a job for your developer.

# TagsSecurityWordPress

The WPhost team27 Oct 202610 min read

On 21 October 2026 WPScan disclosed three vulnerabilities in the ACF Extended plugin and in its paid edition, ACF Extended PRO. On 23 October they were added to the NVD database as well (CVE-2026-94267, CVE-2026-94268 and CVE-2026-94262). The most serious one scores 9.0 on the CVSS scale and, on sites set up a certain way, lets a visitor with no account run their own code on the server. The other two score 8.1 and lead to user accounts being taken over, the administrator's included. The fix is in version 0.9.2.8, released on 19 October. According to wordpress.org, the free edition has more than 100,000 active installations.

ACF Extended is an add-on for Advanced Custom Fields (ACF), but it is a separate plugin, with a different author and its own version numbers. The CVE records list only ACF Extended and ACF Extended PRO, so ACF itself is not affected by these three flaws.

What the three flaws allow

CVE	CVSS	What it allows	Affected versions
CVE-2026-94267	9.0	Overwriting posts and running code on the server	All before 0.9.2.8
CVE-2026-94268	8.1	Taking over the administrator's account	0.9.2.7
CVE-2026-94262	8.1	Taking over any account that is not an administrator	0.9.2.7

All three sit in the Forms module, which ACF Extended uses to show forms to the site's visitors, for example to edit a profile or submit a post. None of them requires logging in.

The first concerns forms that update a post. The plugin does not check whether the visitor is allowed to do that, so anyone can overwrite any post, including the entries where the site stores its own field definitions. According to the record, that leads on to running code on the server. Whoever can run code on the server controls the whole site and its database, and on a store that means customer and order data too.

The other two concern forms that update a user. According to the author's release notes, a check protecting administrator accounts was added in version 0.9.2.7. The record for CVE-2026-94262 says the plugin checks permissions only when the target account is an administrator. That lets a visitor change the login details of any other account, an editor or a store customer for instance, and log in as them. CVE-2026-94268 gets past the check itself, because the plugin works out the target account one way when it authorises the request and another way when it carries it out. The attacker ends up holding the administrator's account and logged in with it.

When the attack works

On the CVSS scale all three have high attack complexity, because the attack only works if the site publishes an ACF Extended form with particular settings. The CVSS score guide explains what these scores mean. Each record describes its own condition.

For CVE-2026-94267, the form updates a post, and both the target post and the content come from what the visitor submits.
For CVE-2026-94268, the site has two separate forms that update users, and in both the target account comes from the visitor's input.
For CVE-2026-94262, the form updates a user, and the target account comes from the visitor's input instead of the current user, which is the default.

A site that uses ACF Extended only in the admin area, for fields and post types, and shows no forms to visitors, is not exposed according to these three records. The Forms module is switched on by default, though, and a form may have been built by a developer years ago and long forgotten.

As of 23 October, CISA notes in the records that there is no evidence of attacks using these flaws. WPScan will publish its proof of concept, the sample attack code, on 21 November 2026. After that anyone who wants to can repeat the attack, so update before then.

Is your site affected?

It is if you have "Advanced Custom Fields: Extended" or "Advanced Custom Fields: Extended PRO" on a version below 0.9.2.8. You can see the version under Plugins > Installed Plugins. Do not confuse it with the version of "Advanced Custom Fields" or "Advanced Custom Fields PRO", which is a different plugin with different numbering. In cPanel's Terminal, the command below shows both plugins side by side. The WP-CLI guide explains how to work with WP-CLI.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Shows the versions of ACF and ACF Extended.
wp plugin list --fields=name,title,status,version \
  --skip-plugins --skip-themes | grep -iE "acf|custom-fields"

The next command lists the ACF Extended forms stored in the database. If it prints none, the site most likely shows no such forms.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Lists the ACF Extended forms.
wp post list --post_type=acfe-form --post_status=any \
  --fields=ID,post_title,post_status

In the admin area the same forms are in the ACF menu, under Forms. Open each one and look at its actions. The ones that need attention are a Post action set to Update post and a User action set to Update user whose Target field is linked to a field in the form rather than to Current Post or Current User. A form can also be defined in the theme's code, so if in doubt, ask whoever built the site.

What to do

Back up the files and the database, as described in the backup guide.
Update ACF Extended to 0.9.2.8 or later from Plugins > Installed Plugins or Dashboard > Updates. The PRO edition receives updates only with an active licence, which is entered in the plugin's admin panel. If the licence has expired, the update will not appear, so check it. The plugin update guide shows how to update without breaking the site.
After updating, check the version again and open the pages that have forms. In version 0.9.2.8 the [acfe_form] shortcode accepts only allowed arguments, and Template Tags are no longer permitted in them. If a form stops working, that may be the reason, and it is a fix for your developer.
If the site has forms of the kind described and ran a vulnerable version, check under Users for administrators you do not recognise and make sure the email address on your own account has not been changed. If anything looks wrong, work through the guide for a hacked site.
If you cannot update right away, take the forms that update posts or users off your pages. The attack needs the form to be published, so without it there is no way in. This is a stopgap and does not replace the update.

What we do

With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add it, write to us through the inquiry form.

Frequently asked questions

What vulnerabilities were found in ACF Extended?

Three vulnerabilities in ACF Extended and its paid edition ACF Extended PRO, numbered CVE-2026-94267, CVE-2026-94268 and CVE-2026-94262 and disclosed by WPScan on 21 October 2026. The most serious scores 9.0 on CVSS and, on sites set up a certain way, lets a visitor with no account run their own code on the server. The other two score 8.1 and lead to user accounts being taken over, the administrator's included.

Which version of ACF Extended fixes the vulnerabilities?

ACF Extended 0.9.2.8, released on 19 October 2026. CVE-2026-94267 affects every version before 0.9.2.8, while CVE-2026-94268 and CVE-2026-94262 affect version 0.9.2.7.

Is the Advanced Custom Fields plugin itself affected?

No. ACF Extended is an add-on for Advanced Custom Fields (ACF), but it is a separate plugin with a different author and its own version numbers. The CVE records list only ACF Extended and ACF Extended PRO, so ACF is not affected by these three flaws.

Is my site affected if I use ACF Extended only in the admin?

According to the three records, a site that uses ACF Extended only in the admin for fields and post types, and shows no forms to visitors, is not exposed. All three flaws sit in the Forms module, which shows forms to visitors, for example to edit a profile or submit a post. The Forms module is on by default, though, and a form may have been built by a developer years ago and long forgotten.

How do I check whether my site has ACF Extended forms?

In cPanel's Terminal, wp post list --post_type=acfe-form --post_status=any lists the ACF Extended forms in the database and changes nothing. In wp-admin the same forms are in the ACF menu, under Forms. The ones that need attention are a Post action set to Update post and a User action set to Update user whose Target field is linked to a form field rather than Current Post or Current User.

Why do I see no update for ACF Extended PRO?

ACF Extended PRO receives updates only with an active licence, which is entered in the plugin's admin panel. If the licence has expired, the update to 0.9.2.8 will not appear, so check it.

Will my form stop working after updating to ACF Extended 0.9.2.8?

It might. In version 0.9.2.8 the [acfe_form] shortcode accepts only allowed arguments, and Template Tags are no longer permitted in them. If a form stops working after the update, that may be why, and the fix is a job for your developer.

By when should I update ACF Extended?

Before 21 November 2026, when WPScan publishes its sample attack code and sites on an old version become an easy target. As of 23 October, CISA notes in the records that there is no evidence of attacks. If you cannot update right away, take the forms that update posts or users off your pages, though that does not replace the update.

Sources