WordPress Plugin Fails to Verify User Edit Authorization

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-94262 is an authorization bypass vulnerability in the Advanced Custom Fields: Extended WordPress plugin that allows unauthenticated attackers to modify user account credentials for non-administrator accounts. The vulnerability exists in the front-end Forms module's update-user action, which only performs authorization checks for administrator-level targets, leaving all standard user accounts exposed. Organizations running affected versions (prior to 0.9.2.8) face immediate risk of account takeover, privilege escalation, and lateral movement, particularly on WordPress sites that expose user registration or profile editing forms to anonymous visitors.

Casky's 283 matched security skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection patterns identifying: (1) unauthorized PUT/POST requests to user update endpoints lacking valid authentication tokens, (2) CWE-863 authorization check failures that bypass role-based access controls, and (3) anomalous account modification activities originating from unauthenticated sessions. The platform's skill mapping would surface attack chains showing how credential harvesting leads to session hijacking, enabling attackers to move through WordPress infrastructure and compromise connected systems—critical insights for defensive prioritization and incident response.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94262.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-94262

Casky has 283 skills that investigate the attack patterns behind CVE-2026-94262. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn