CVE-2026-112312: WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ACF Extended pluginto a version that resolves this vulnerability.Fixed in 0.9.2.8
Event History
Frequently Asked Questions
Which deployments are affected?
ACF Extended installations through version 0.9.2.7 are affected. The available data does not identify any configuration prerequisite or unaffected configuration.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact?
The vulnerability is rated high severity with a 7.5 score and is assessed as having high confidentiality impact. The provided data indicates no integrity or availability impact.