Risk Letters

Exploited vulnerability

CVE-2026-8809

TLP:CLEAR

acfextended advanced_custom_fields_extended Improper Privilege Management

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter — with no authentication or integrity verification — to select a cleanup branch that sil

Facts

  • Vendor: acfextended
  • Product: advanced_custom_fields_extended
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 0.8 %
  • First known exploitation: 13 October 2026
  • First seen by Risk Letters: 29 May 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD