Is CVE-2026-8809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8809 being exploited in the wild.

How severe is CVE-2026-8809?

Critical severity, with a CVSS score of 9.8, published 28 May 2026.

Which products and versions are affected?

ACF Extended Advanced Custom Fields: Extended up to and including 0.9.2.5.

Is there a fix for CVE-2026-8809?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8809 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8809?

Check whether you run ACF Extended Advanced Custom Fields: Extended at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8809: ACFE Advanced Custom Fields: Extended privilege escalation via validation bypass

CVE-2026-8809 · Severity: critical · CVSS 9.8 · Published 2026-05-28

A vulnerability in a popular WordPress plugin extension allows unauthorized individuals to create new administrator accounts on affected websites. By bypassing security checks during user registration, an attacker can gain full control over the site's management and data. This issue specifically affects sites using public-facing forms configured to create new users.

Technologies: ACF Extended Advanced Custom Fields: Extended. Vendors: ACF Extended.

Quick answers

Is CVE-2026-8809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8809 being exploited in the wild.
How severe is CVE-2026-8809?: Critical severity, with a CVSS score of 9.8, published 28 May 2026.
Which products and versions are affected?: ACF Extended Advanced Custom Fields: Extended up to and including 0.9.2.5.
Is there a fix for CVE-2026-8809?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8809 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8809?: Check whether you run ACF Extended Advanced Custom Fields: Extended at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is caused by the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter without authentication or integrity verification. This allows an attacker to trigger a cleanup branch that discards validation errors not prefixed with 'acfe:', effectively suppressing security checks for role allow-lists and administrator-role capability guards. Consequently, an unauthenticated attacker can force the wp_insert_user() function to execute with an administrator role argument. Exploitation requires a public ACFE frontend form configured with a 'Create User' action that maps a role field. A patch is available in versions following 0.9.2.5.

Affected products

ACFE Advanced Custom Fields: Extended (ACFE) up to and including 0.9.2.5

Timeline

2026-05-28: disclosed
2026-05-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.