Advanced Custom Fields: Extended vulnerabilities
We track 5 vulnerabilities in Advanced Custom Fields: Extended products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Advanced Custom Fields: Extended vulnerabilities
- 8.1 High severity
Advanced Custom Fields: Extended: Improper Privilege Management
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that a
- 9.0 Critical severity
Advanced Custom Fields: Extended: Improper Control of Generation of Code
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenti
- 8.1 High severity
Advanced Custom Fields: Extended: Incorrect Authorization
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front
- 8.1 High severity
Advanced Custom Fields: Extended: Improper Privilege Management
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated
- 8.1 High severity
Advanced Custom Fields: Extended: Improper Authentication
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role