CVE-2026-12526: ACF Extended WordPress Auth Bypass Flaw

CVE-2026-12526 Overview

CVE-2026-12526 is an authentication bypass vulnerability in the Advanced Custom Fields: Extended WordPress plugin before version 0.9.2.7. The plugin's front-end Forms module fails to verify that a requester is authorized to edit the targeted user account in the update-user action. A capability check runs only when the submitted role is administrator or super_admin, leaving password updates for other cases unprotected. An unauthenticated attacker can overwrite an administrator's password and take over the account when a public form is configured to target another user and maps password to a visitor-submitted field.

Critical Impact
Unauthenticated attackers can hijack administrator accounts on vulnerable WordPress sites that expose a misconfigured front-end user-update form, leading to full site compromise.

Affected Products

Advanced Custom Fields: Extended WordPress plugin versions prior to 0.9.2.7
WordPress sites exposing the plugin's front-end Forms module update-user action
Sites where the form targets a fixed account or a visitor-controlled user field

Discovery Timeline

2026-09-02 - CVE-2026-12526 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-12526

Vulnerability Analysis

The vulnerability is classified as Improper Authentication [CWE-287]. The Advanced Custom Fields: Extended plugin ships a front-end Forms module that lets site builders publish forms allowing visitors to update user profile data. The update-user action handler determines whether to apply an authorization check based on the value of the submitted role field. When the role is administrator or super_admin, the handler enforces a capability check. For any other submitted value, or when no role is submitted, the handler proceeds without confirming that the caller can edit the target user.

Because the target user identifier and individual profile fields, including user_pass, can be bound to visitor-submitted inputs, an attacker can submit a form payload that identifies an existing administrator as the target and provides an attacker-chosen password. The handler writes the new password without verifying the caller's identity or permissions. The default configuration targets the submitting user, so exploitation requires that a site operator has deployed a form targeting another account and mapped the password field to visitor input.

Root Cause

The root cause is a conditional authorization check that is scoped to the submitted role value rather than to the target user. The code path assumes that only privileged role assignments require verification, ignoring that overwriting the password of any account, including an administrator, is itself a privileged operation. The check should validate current_user_can('edit_user', $target_user_id) on every branch.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker locates a vulnerable public form whose update-user action targets an existing administrator, either as a fixed identifier or as a mapped visitor input. The attacker submits the form with a chosen password, and the plugin overwrites the administrator credential. The attacker then authenticates through wp-login.php as the administrator.

See the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-12526

Indicators of Compromise

Unexpected user_pass changes in wp_users for administrator accounts without corresponding password-reset emails or admin activity
HTTP POST requests to front-end pages hosting the Advanced Custom Fields: Extended form endpoint containing acfe_form_name or update-user action parameters from unauthenticated sessions
New administrator logins from unfamiliar IP addresses or geolocations immediately after form submissions
Session tokens created for administrator accounts without a preceding valid login flow

Detection Strategies

Review WordPress access logs for POST requests targeting pages containing Advanced Custom Fields: Extended forms and correlate with subsequent administrator authentications
Audit all published front-end forms and flag any with the update-user action, particularly those with password fields mapped to visitor input or with non-default user targeting
Compare user_pass hash timestamps with the WordPress activity log to identify silent password changes

Monitoring Recommendations

Alert on any modification to administrator accounts in wp_users and wp_usermeta outside change-management windows
Monitor for successful wp-login.php authentications by administrator accounts following anonymous POST traffic to form endpoints
Ingest WordPress and web server logs into a centralized analytics platform to correlate form submissions with account changes

How to Mitigate CVE-2026-12526

Immediate Actions Required

Update the Advanced Custom Fields: Extended plugin to version 0.9.2.7 or later on all WordPress sites
Audit every published front-end form for the update-user action and remove or reconfigure forms that target accounts other than the submitting user
Rotate passwords for all administrator and super-admin accounts and force reauthentication of active sessions
Review recent administrator logins and audit for unauthorized site changes, new plugins, or injected content

Patch Information

The plugin vendor released version 0.9.2.7, which adds the missing authorization check to the update-user action so that permission is validated regardless of the submitted role. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable or unpublish any front-end forms that use the update-user action until the plugin is updated
Remove password field mappings from front-end user-update forms so that credentials cannot be set from visitor input
Restrict access to pages hosting user-update forms behind authentication or IP allowlists at the web server or WAF layer
Deploy a WAF rule blocking unauthenticated POST requests that include user_pass parameters to pages hosting Advanced Custom Fields: Extended forms