WordPress Plugin Allows Unauthenticated Admin Account Creation

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-80467 affects the Advanced Custom Fields: Extended WordPress plugin versions before 0.9.2.7, exposing a critical privilege escalation vulnerability. The plugin fails to properly validate user roles submitted through front-end registration forms, allowing unauthenticated attackers to bypass role restrictions and register accounts with elevated privileges. The vulnerability's incomplete safeguards against privileged roles enable attackers to further escalate their newly created accounts to administrator level without authentication. This directly impacts any WordPress site using the vulnerable plugin version, affecting site owners, administrators, and their users who may have sensitive data exposed to unauthorized administrative access.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to identify the attack chain associated with TA0004 (Privilege Escalation) techniques embedded in this vulnerability. Practitioners using Casky would observe detection patterns focusing on: improper input validation in role assignment parameters, missing authorization checks on privileged account creation endpoints, and insufficient server-side verification of user-submitted capability claims. The platform's skill set would flag suspicious registration requests containing role or capability fields outside the form's defined offerings, unauthenticated account creation with admin-level permissions, and post-registration privilege escalation attempts. These detections map directly to CWE-269 (Improper Access Control), enabling security teams to identify both exploitation attempts and misconfigurations in custom field handling before attackers achieve persistent administrative access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-80467.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-80467

Casky has 224 skills that investigate the attack patterns behind CVE-2026-80467. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn