CVE-2026-94267

The record

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.

Affected packages

Related vulnerabilities

• CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query… CWE-94
• CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-63345 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-94
• CVE-2026-62284 OSAC operator is a Kubernetes operator. CWE-94
• CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. CWE-94
• CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory… CWE-94