Understanding and Defending Against CVE-2026-94262: Unauthenticated User Account Compromise in WordPress Plugins
CVE-2026-94262 is a high-severity vulnerability affecting the Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins. This vulnerability allows unauthenticated attackers to overwrite non-administrator user accounts and gain a session for those accounts. The vulnerability has a CVSS score of 8.1 and requires specific conditions to be exploitable.