The Advanced Custom Fields: Extended plugin for WordPress has been patched against three flaws that let an anonymous visitor take control of a site. The free and PRO versions below 0.9.2.8 are affected.
What happened
The worst of them, CVE-2026-94267, is an unauthenticated remote code execution flaw scored 9.0 by Patchstack. The plugin's front-end form action that updates a post performs no capability check, so a visitor can overwrite any post, including the posts that store the site's own field definitions. Rewriting those definitions is what turns the bug into code execution on the server.
Two account takeover paths sit alongside it. CVE-2026-94268 lets an unauthenticated visitor bypass the guard protecting administrator accounts and obtain a valid session as the site administrator. CVE-2026-94262 does the same for non-administrator accounts. Both are scored 8.1.
Credited to Jakub Herman and Karthik Ramakrishnan, with fixes released on 23 October 2026 in version 0.9.2.8. There is no confirmed exploitation in the wild at the time of writing.
Who is affected
Sites running ACF Extended or ACF Extended PRO below 0.9.2.8, where the exposure depends on how the forms are configured.
- WordPress sites with the free or PRO plugin below 0.9.2.8
- Any site using the plugin's front-end Forms module, which many agencies enable for user-submitted content
- Specifically, forms where the post update or user update action takes its target or content from submitted values
- Multisite and client-managed installs where plugin updates are handled by hand
What to do now
Update ACF Extended and ACF Extended PRO to 0.9.2.8 or later today, then check whether any administrator account on the site was created or changed without your knowledge.
- Update the plugin from the WordPress plugins screen, or push 0.9.2.8 through your management tooling
- List all administrator accounts and remove any you cannot account for, including ones with generic names
- Review front-end forms that update posts or user records, and stop mapping their target or content fields to visitor input
- Reset administrator passwords and force a re-login if the site ran the vulnerable version on a public form
- Check server logs for POST requests to form endpoints from addresses you do not recognise
What this means for South African businesses
A plugin that adds custom fields is not the sort of component most owners think about, yet this one sits on sites where an anonymous visitor can end up with administrator rights. A site compromised this way is usually found months later, when it starts serving spam or gets flagged by Google.
In practice the SMEs most exposed here are the ones whose WordPress site was built once by a freelancer, handed over without a maintenance agreement, and has not had a plugin update since.
Source: Patchstack
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.