External risk intelligence

Advanced Custom Fields Extended Plugins Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-94267

The vulnerability resides in a WordPress plugin that manages front-end forms. These forms are designed to be publicly accessible on the web to collect user input, making the vulnerable surface commonly exposed to the internet as part of the normal functionality of the website.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in specific WordPress plugins that could allow unauthenticated visitors to overwrite essential site content, potentially leading to the execution of arbitrary code on the server. This issue arises when a form's post-update action is configured to accept visitor-submitted values for both its target and content.

Unauthenticated users can overwrite site content.
This could lead to unauthorized code execution.
Confirm relevance and exposure of affected plugins.

Attack Path

How an attacker could exploit the issue

An unauthenticated visitor can manipulate front-end forms to overwrite arbitrary posts, including those containing critical site field definitions. This manipulation can lead to the execution of arbitrary code on the server, provided a specific form configuration is in place.

Publicly accessible form.
Update post without capability check.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated visitors could overwrite arbitrary posts through front-end forms, potentially impacting site field definitions and leading to arbitrary code execution.

Site posts and field definitions.
Unauthenticated form submission.
Arbitrary code execution on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects WordPress sites utilizing specific Advanced Custom Fields plugins for front-end forms. Website owners, application administrators, and potentially the plugin vendor should be involved. The first step is to identify all instances of the affected plugins, determine if their forms are publicly accessible, and assess the business criticality of the impacted content before planning remediation.

Website and application owners should coordinate.
Verify all public-facing form usage.
Plan vendor engagement or plugin update.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advanced Custom Fields: Extended WordPress plugin?

This plugin extends the functionality of the standard Advanced Custom Fields tool by allowing developers to build front-end forms. These forms enable website visitors to submit data directly to the site, which the plugin then processes to update WordPress posts or other structured content automatically.

What does CVE-2026-94267 mean for a WordPress site?

This vulnerability involves a flaw in how the plugin handles front-end form submissions. It is classified as CWE-94, or Improper Control of Generation of Code. Because the plugin lacks necessary permission checks, an attacker can overwrite existing site data, which may allow them to inject and run malicious code on the server.

How can an attacker trigger this vulnerability?

An attacker needs to interact with a specific, improperly configured front-end form on the website. The vulnerability is only triggered if the form's post-update action is set to accept both the target post and the content directly from the visitor. If a form does not allow users to specify these parameters, the bug cannot be triggered in that specific way.

Is my site at risk according to Halo Surface Signal?

Yes, if you use these plugins and host front-end forms accessible to the public, your site is likely exposed. Halo Surface Signal identifies these forms as typically internet-facing because their primary purpose is to collect data from web users, meaning an attacker does not need internal access to reach the vulnerable component.

Do I need to do anything if I run this technology?

Yes. Start by auditing your WordPress site to locate every instance where these specific plugins are used. Determine which pages contain front-end forms and verify if those forms are publicly accessible. Once identified, consult the plugin developer’s instructions to update your software to the latest version to apply the necessary security patches.

References

wpscan.com/vulnerability/9c8f45c1-cd85-4a9c-be77-88801d8143ce/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.