Description

Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T16:18:29.120Z",
  "pubdate": "2026-08-28T16:18:29.120Z",
  "executiveSummary": "ACF Extended versions 0.9.2.6 and below contain a critical broken access control vulnerability. This flaw allows users with low-level privileges, such as the Contributor role, to perform actions typically restricted to higher-privileged administrators.\nThe vulnerability manifests due to improper authorization checks within the plugin's functional components. By exploiting this flaw, authenticated attackers can manipulate settings, execute unauthorized administrative operations, or potentially access sensitive data within the WordPress environment.\nThe risk implication is significant as it undermines the principle of least privilege, enabling vertical privilege escalation. Exploitation requires the attacker to be authenticated as a user with at least Contributor-level access. Once the baseline authentication is met, the attacker can leverage the lack of server-side capability verification to bypass intended security constraints, leading to full site configuration compromise or arbitrary data manipulation.",
  "technicalDetails": "The vulnerability is rooted in insufficient capability checks (e.g., current_user_can()) within the ACF Extended administrative interface modules. Specifically, the plugin fails to enforce proper access control lists (ACLs) on backend request handlers, allowing requests originating from users with 'contributor' capability to access administrative endpoints or process hidden administrative tasks.\nIn the WordPress environment, the Contributor role is strictly limited to drafting and editing their own posts without the capability to publish or manage site-wide settings. The ACF Extended plugin improperly exposes administrative functionality by failing to validate that the requestor possesses the 'manage_options' or 'administrator' role before executing sensitive operations.\nThe attack flow begins with the authenticated Contributor identifying a target administrative URL or API endpoint processed by the ACF Extended plugin. Upon sending a crafted POST or GET request to these endpoints, the server-side code fails to verify the integrity of the user's privilege level. Consequently, the application proceeds to execute the requested business logic, such as modifying Field Groups, saving plugin settings, or triggering administrative callbacks.\nBecause the plugin does not implement granular capability checks, the application code treats requests from a Contributor as if they originated from an administrative source. The lack of proper nonce verification or server-side authorization checks for specific actions allows an attacker to manipulate site configuration parameters that should be restricted.\nThis vulnerability is particularly severe because it allows for persistent changes to the application's configuration. An attacker could potentially inject malicious configurations that affect how content is rendered or how administrative workflows are processed. Furthermore, if the plugin's internal functions perform secondary actions (e.g., file writing, database manipulation), an attacker may escalate this access to achieve deeper system impact. The vulnerability remains present in all versions up to and including 0.9.2.6. Successful exploitation is limited to authenticated users; however, it does not require specialized technical expertise, as simple request tampering using standard browser developer tools or intercepting proxies like Burp Suite is sufficient to trigger the unauthorized operations."
}