WordPress security by component
Advanced Custom Fields: Extended
Plugin description
Advanced Custom Fields: Extended is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published May 28, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
acf-extendedLatest vulnerability
CVE-2026-8809: Advanced Custom Fields: Extended: Privilege escalation or authentication bypass
Advanced Custom Fields: Extended is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 0.9.2.5. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
| Safe version |
|
||
|---|---|---|---|
| May 28, 2026 |
CVE-2026-8809
Advanced Custom Fields: Extended: Privilege escalation or authentication bypass
Advanced Custom Fields: Extended is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 0.9.2.5. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE9.8
NVDPending
|
| May 12, 2026 |
CVE-2025-15463
Advanced Custom Fields: Extended: A security weakness
Advanced Custom Fields: Extended is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 0.9.2.3. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jan 20, 2026 |
CVE-2025-14533
Advanced Custom Fields: Extended: Privilege escalation or authentication bypass
Advanced Custom Fields: Extended is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Oct 20, 2023 |
CVE-2023-5292
Advanced Custom Fields: Extended: Cross-site scripting
Advanced Custom Fields: Extended is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.4
NVD5.4
|