Unknown Advanced Custom Fields: Extended vulnerabilities

2 CVEs affecting Unknown Advanced Custom Fields: Extended, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-80467, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-80467, published 2026-09-02. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard…
CVE-2026-12526, published 2026-09-02. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end…