Description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T06:17:15.817Z",
  "pubdate": "2026-09-02T06:17:15.817Z",
  "executiveSummary": "The Advanced Custom Fields: Extended WordPress plugin prior to version 0.9.2.7 contains a critical access control vulnerability within its front-end Forms module.\nThe vulnerability is classified as an Improper Authorization flaw, allowing unauthenticated or low-privileged users to modify arbitrary user accounts, including administrator accounts.\nThe root cause lies in the insufficient validation of user authorization during the 'update-user' action. While the plugin checks for specific administrative capabilities when a role change is requested, it fails to perform mandatory ownership or authorization verification for general user profile updates.\nThis flaw allows a remote attacker to manipulate form submissions to overwrite existing user passwords or profile details. If an attacker directs this request toward a privileged account, they can achieve full site compromise through account takeover.\nExploitation requires the site to host a front-end form configured to target an arbitrary account rather than the submitting user. The impact includes unauthorized access, privilege escalation, and complete administrative control over the WordPress installation.\nAll installations of the Advanced Custom Fields: Extended plugin below version 0.9.2.7 are considered vulnerable. Immediate patching to the latest version is required to mitigate this high-risk security exposure.",
  "technicalDetails": "The vulnerability exists within the front-end Forms module of the Advanced Custom Fields: Extended plugin, specifically in the processing logic for the 'update-user' action. The component fails to enforce proper authorization checks to ensure that the current requester has the necessary permissions to modify the user profile targeted by the form submission.\nThe architectural flaw is identified in the conditional logic of the update procedure. The plugin implements a capability check only when the submitted data includes role-based modifications, such as assigning 'administrator' or 'super_admin' roles. For standard user profile updates, the system assumes the request is legitimate and fails to verify if the user attempting to update the profile is the account owner or possesses administrative authority to manage other users.\nIn a typical attack scenario, an attacker leverages a publicly accessible front-end form that has been configured by a site administrator to support user updates. By intercepting the request or manipulating the hidden fields that define the target user ID, an attacker can designate an existing administrator account as the target of the form submission. Because the application processes these form inputs without verifying the requester's identity against the target's identity, it performs a password or profile update on the victim's account.\nThe attack flow follows these distinct steps: First, the attacker identifies a form on the front-end that triggers the 'update-user' action. Second, the attacker manipulates the form data to include a target user ID (e.g., the administrator's ID) and a new, controlled password field. Third, the submission is dispatched to the server, where the plugin's vulnerable function handles the request. Fourth, because the security check for non-role modifications is missing, the plugin updates the password in the WordPress database for the specified account. Finally, the attacker authenticates as the hijacked administrator, gaining full control over the target WordPress environment.\nThis vulnerability is particularly severe because it bypasses standard WordPress authentication mechanisms through a feature intended for legitimate user profile management. The lack of validation on the target account ID combined with the ability to map password fields allows for persistent, unauthenticated access to the highest level of system privileges. This issue affects all versions of the Advanced Custom Fields: Extended plugin prior to 0.9.2.7."
}