CVE-2026-8809: Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

Synopsis

This is an unauthenticated privilege escalation in the Advanced Custom Fields: Extended WordPress plugin, affecting all versions up to and including 0.9.2.5. The bug is reachable over the network with no authentication and no user interaction: the after_validate_save_post() function trusts the attacker-controlled _acf_post_id POST parameter to select a cleanup branch that silently drops validation errors, letting an attacker bypass the role allow-list and administrator capability checks. Successful exploitation creates a new administrator-level WordPress account, giving full control of the site. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach a public ACFE frontend form over the network on the target WordPress site.

• AuthenticationNot required

  No account or session is needed; the validation bypass is triggered by an unauthenticated POST request.

• Victim interactionNot required

  No administrator or user action is required; the attacker submits the crafted form directly.

• Attack complexityDetail

  The CVSS vector lists AC:L, meaning the exploit is reliable as long as the site exposes an ACFE form with a Create User action mapping a role field.

Blast Radius

• Creates a new administrator-level WordPress user account chosen by the attacker, granting full control of the site.
• Allows subsequent installation of arbitrary plugins or themes, which is a standard path to remote code execution on the underlying container.
• Permits reading and modifying all WordPress content, user records, and stored credentials or API tokens held in site options.
• Enables disruption of the site by deleting content, locking out legitimate administrators, or taking the application offline.