Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Advanced Custom Fields: Extended | 0.9.2.2 – < 0.9.2.7 | 0.9.2.7 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
SangSenimanWartefak/CVE-2026-80467 ★ 0 · Sep 17, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://wpscan.com/vulnerability/929f243b-2f1c-4eca-88bc-03b1a86270ed/ exploit vdb-entry technical-description