CVE-2026-8809

The Advanced Custom Fields: Extended plugin for WordPress contains a vulnerability affecting versions up to 0.9.2.5, which allows unauthenticated attackers to bypass validation checks and create administrator-level user accounts. This is due to the after_validate_save_post function's failure to verify the authenticity of the _acf_post_id POST parameter, allowing it to be manipulated by an attacker. As a result, the plugin's intended role restrictions are circumvented, enabling attackers to execute wp_insert_user with arbitrary administrator roles.

Based on public CVE data (MITRE/NVD).