High severity · published Sep 2, 2026
CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Advanced Custom Fields: Extended ·
0.9.2.2 before 0.9.2.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80467
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80467
wpscan.com
https://wpscan.com/vulnerability/929f243b-2f1c-4eca-88bc-03b1a86270ed/
More from Advanced Custom Fields: Extended
9.0
CVE-2026-94267
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
8.1
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
8.1
CVE-2026-94262
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
8.1
CVE-2026-12526
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
6.8
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes