Advanced Custom Fields: Extended PRO vulnerabilities
We track 3 vulnerabilities in Advanced Custom Fields: Extended PRO products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Advanced Custom Fields: Extended PRO vulnerabilities
- 8.1 High severity
Advanced Custom Fields: Extended: Improper Privilege Management
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that a
- 9.0 Critical severity
Advanced Custom Fields: Extended: Improper Control of Generation of Code
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenti
- 8.1 High severity
Advanced Custom Fields: Extended: Incorrect Authorization
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front