Security Alert Summary
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 contains a flaw in its front-end user registration handling that can allow unauthenticated visitors to register accounts with elevated roles and subsequently escalate to administrator. Site owners should verify plugin versions and user registrations until updates or mitigations are applied.
CVE Details
- CVE ID: CVE-2026-80467
- Affected component: Advanced Custom Fields: Extended WordPress plugin
- Affected versions: Version 0.9.2.2 (and versions less than 0.9.2.7)
- Published: September 2, 2026, 06:17:18 AM UTC
- Last modified: September 2, 2026, 11:17:22 AM UTC
- CVSS v3.1: Base Score 8.1, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Privileges Required: NONE; User Interaction: NONE; Attack Complexity: HIGH
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE: CWE-269 (Improper Privilege Management)
Technical Details
The plugin does not properly restrict the role value submitted through its front-end user forms to the set of roles actually offered by the form. Additionally, the safeguard intended to prevent assignment of privileged roles is incomplete. As described, these weaknesses allow an unauthenticated visitor to register an account with elevated capabilities and then escalate that account to an administrator role.
No specific functions or REST endpoints are named in the advisory. The root cause is a failure to validate and enforce the role parameter server-side against an allowlist and to fully block elevation to privileged roles during registration and role update flows.
Impact is limited to the capability to create and elevate user accounts: an attacker who can register an account with elevated capabilities may perform administrative actions once escalation to administrator occurs. The description does not state exploitation details or available exploits.
How This Could Impact Your Website
Consider a small WordPress site with three types of users: the site owner (administrator), internal staff who publish content (editors or authors), and external contributors or contractors who submit content via front-end forms. If the plugin is in use and an attacker is able to register an account with elevated capabilities, that account could be used to modify content, view restricted data, or change site settings once it is escalated to an administrator.
Practical consequences include exposure of internal user email addresses and account metadata, and an increased risk of targeted phishing or social engineering against staff or contractors whose accounts and roles are visible. These outcomes align with the CVSS impacts to confidentiality and integrity rather than implying guaranteed full-site compromise.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any roles that can be promoted.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit front-end registration forms for role-related inputs.
- Monitor site activity and logs for unusual account creation or role changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
