Critical Vulnerability in Advanced Custom Fields: Extended WordPress Plugin Allows Arbitrary Code Execution
A critical vulnerability, CVE-2026-94267, with a CVSS score of 9, was discovered in the Advanced Custom Fields: Extended WordPress plugin. This vulnerability allows unauthenticated visitors to overwrite arbitrary posts, leading to arbitrary code execution on the server. The affected plugins are Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO, both before version 0.9.2.8. Immediate patching is recommended to prevent potential exploitation.