Unauthenticated Post Overwrite in Advanced Custom Fields Plugin

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Advanced Custom Fields: Extended WordPress plugin before version 0.9.2.8 contains a critical authorization bypass vulnerability that allows unauthenticated visitors to modify arbitrary posts on affected websites. By exploiting missing capability checks in front-end form actions, attackers can overwrite any post, including those containing field definitions that control plugin behavior. This creates a direct pathway to arbitrary code execution since field definitions can be manipulated to inject malicious code. The vulnerability affects any WordPress site using the vulnerable plugin versions that exposes custom forms to the internet, making it particularly dangerous for organizations using ACF Extended for user-facing content management or data collection workflows.

Casky's 323 mapped skills detect this attack pattern by correlating indicators across MITRE ATT&CK Initial Access (TA0001) and Resource Development (TA0043) techniques. Practitioners using Casky would observe detection signals for unauthorized post modification attempts, unexpected changes to plugin field definitions, and post update requests from unauthenticated sources—patterns that Claude's extended reasoning engine recognizes as inconsistent with legitimate WordPress behavior. The skills identify the authentication bypass (CWE-94: Improper Control of Generation of Code) as a precursor to code execution, surfacing findings that show unauthorized POST requests modifying post content without valid user sessions, followed by changes to plugin configuration fields that could enable payload execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94267.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-94267

Casky has 323 skills that investigate the attack patterns behind CVE-2026-94267. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn