CVE-2026-80467: ACF Extended WordPress Privilege Escalation

CVE-2026-80467 is a privilege escalation vulnerability in Advanced Custom Fields Extended WordPress plugin allowing unauthenticated attackers to register accounts with elevated privileges and escalate to administrator access. This post covers technical details, affected versions, impact, and mitigation steps.

CVE-2026-80467 Overview

CVE-2026-80467 is a privilege escalation vulnerability in the Advanced Custom Fields: Extended WordPress plugin before version 0.9.2.7. The plugin fails to restrict the role submitted through its front-end user forms to the roles the form actually offers. Its safeguard against privileged roles is also incomplete. Unauthenticated visitors can register an account with elevated capabilities and then escalate that account to administrator. This weakness is classified as Improper Privilege Management [CWE-269].

Critical Impact
Unauthenticated attackers can create WordPress administrator accounts, leading to full site takeover, arbitrary content modification, and code execution via plugin or theme upload.

Affected Products

Advanced Custom Fields: Extended WordPress plugin
All versions prior to 0.9.2.7
WordPress sites exposing the plugin's front-end user registration forms

Discovery Timeline

2026-09-02 - CVE-2026-80467 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-80467

Vulnerability Analysis

The Advanced Custom Fields: Extended plugin provides front-end user forms that allow site visitors to submit registration data, including a role assignment. The plugin processes the role parameter submitted by the client without validating that the submitted value belongs to the list of roles the form was configured to expose. An attacker manipulates the request body to substitute a higher-privileged role.

A secondary safeguard intends to block assignment of privileged roles such as administrator, but this filter is incomplete. Attackers first register an account with an intermediate role that bypasses the incomplete check, then leverage capabilities granted to that role to escalate to administrator. Full compromise follows because a WordPress administrator can install plugins, edit themes, and execute arbitrary PHP.

Root Cause

The root cause is improper privilege management. The plugin trusts client-controlled role input and does not enforce an allowlist tied to the form definition. The privileged-role blocklist is incomplete, missing role identifiers that grant capabilities sufficient for further escalation.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker submits a crafted POST request to the endpoint handling the front-end user form, supplying an unexpected role value. After registration, the attacker authenticates to the resulting account and uses the granted capabilities to promote the account to administrator. See the WPScan Vulnerability Report for further technical detail.

// Code example not available - see WPScan advisory for technical details

Detection Methods for CVE-2026-80467

Indicators of Compromise

Newly created WordPress user accounts with elevated roles that were not provisioned through the admin console
POST requests to front-end user form endpoints containing a role parameter that does not match the form's advertised role options
wp_users and wp_usermeta entries showing role changes to administrator shortly after account creation from unauthenticated sources
Unexpected plugin, theme, or PHP file uploads following new account registration events

Detection Strategies

Review WordPress audit logs for account creation events originating from unauthenticated front-end submissions
Inspect HTTP request bodies to registration endpoints for role parameters containing values outside the form's configured options
Correlate new user registrations with subsequent capability changes or administrative actions within a short time window

Monitoring Recommendations

Enable a WordPress activity logging plugin to record user creation, role changes, and privilege escalations
Alert on any assignment of the administrator role outside of established administrative workflows
Monitor web server logs for POST traffic to Advanced Custom Fields: Extended form handlers and flag anomalous parameter sets

How to Mitigate CVE-2026-80467

Immediate Actions Required

Update the Advanced Custom Fields: Extended plugin to version 0.9.2.7 or later on all WordPress installations
Audit wp_users for accounts created since the plugin was installed and remove or downgrade any unauthorized administrator accounts
Rotate credentials, secret keys, and API tokens for any site suspected of compromise

Patch Information

The vendor addressed the issue in Advanced Custom Fields: Extended version 0.9.2.7. The fix restricts role selection on front-end forms to the roles explicitly offered by the form definition and completes the privileged-role safeguard. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable or remove Advanced Custom Fields: Extended front-end user forms until the plugin can be updated
Deactivate the plugin entirely if front-end registration forms are not required
Deploy a web application firewall rule that rejects requests to the plugin's form endpoints containing a role parameter with unexpected values

bash

# Update the plugin using WP-CLI
wp plugin update acf-extended --version=0.9.2.7

# Verify installed version
wp plugin get acf-extended --field=version

# List all administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered