CVE-2026-8809
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter — with no authentication or integrity verification — to select a cleanup branch that silently discards all validation errors not prefixed with acfe:. This makes it possible for unauthenticated attackers to suppress both the role allow-list validation error added by acfe_field_user_roles::validate_front_value() and the administrator-role capability guard error added by acfe_module_form_action_user::validate_action(), causing wp_insert_user() to execute with an attacker-supplied administrator role argument and resulting in the creation of a new administrator-level user account. Exploitation requires the target site to expose a public ACFE frontend form configured with a Create User action that maps a role field.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe ACFE plugin's after_validate_save_post() function unconditionally trusts the attacker-controlled _acf_post_id POST parameter to select a cleanup branch that silently discards validation errors not prefixed with 'acfe:'. This bypasses role allow-list validation and administrator capability guards, allowing wp_insert_user() to execute with an attacker-supplied administrator role, resulting in creation of new admin-level user accounts by unauthenticated attackers.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify ACFE plugin installation and versionCheck the installed ACFE plugin version by examining the plugin header in wp-content/plugins/acf-extended/acf-extended.php or via the WordPress plugins admin page. Compare the version number against the patched version for CVE-2026-8809.Affected if ACFE is installed and the version is unpatched against this vulnerability.
-
Locate ACFE frontend forms with Create User actionsReview all ACFE forms in the WordPress admin under ACFE > Forms (or the relevant post type where form configurations are stored). Identify any form actions configured as 'Create User'.Affected if At least one ACFE frontend form exists with a Create User action configured.
-
Verify if Create User actions include role field mappingExamine the configuration of each Create User action found. Check whether a role field (such as acfe_field_user_roles) is mapped to assign user roles during user creation.Affected if A Create User action includes a role field mapping, allowing role assignment during user creation.
-
Confirm public form accessibilityInspect the access settings of each form with a Create User action. Determine if the form is set to allow public (non-authenticated) submissions, or if it requires user login. Check for 'require login' or similar access control settings.Affected if The form with Create User action and role mapping is publicly accessible without authentication.
-
Inspect POST request handling for _acf_post_id parameterIf logs or testing access are available, observe whether the _acf_post_id POST parameter can be manipulated to suppress validation errors. This is the mechanism that enables the bypass.Affected if The _acf_post_id parameter is accepted and processed without proper validation on frontend form submissions.
A user is affected if ACFE is installed with an unpatched version, has a publicly accessible frontend form with a Create User action that includes role field mapping, and the form accepts the _acf_post_id parameter without validation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUntil an official patch is released, disable any public-facing ACFE frontend forms configured with Create User actions that map a role field. Consider deploying a WAF rule to block or sanitize the _acf_post_id parameter on forms using ACFE.
ACFE plugin version newer than 0.9.2.5 (verify latest version at wordpress.org/plugins/acf-extended/)
- 1. Navigate to the WordPress admin dashboard and go to Plugins > Installed Plugins
- 2. Locate 'Advanced Custom Fields: Extended' (ACFE) in the plugin list
- 3. Check the current installed version of the plugin
- 4. If the installed version is 0.9.2.5 or lower, click 'Update Now' to install the latest available version
- 5. Alternatively, download the latest version from the WordPress Plugin Repository at plugins.wordpress.org and upload it manually via Plugins > Add New > Upload Plugin
- 6. After updating, verify the new version number in the plugins list
- 7. Review the plugin's changelog to confirm the security fix for CVE-2026-8809 is included
- 8. If using ACFE frontend forms with Create User actions, ensure role fields are properly secured and not exposed to unauthenticated users
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-8809 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-8809 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data