ACF Extended Plugin Privilege Escalation via TOCTOU Flaw

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-94268 is a Time-of-Check-Time-of-Use (TOCTOU) vulnerability in the Advanced Custom Fields: Extended WordPress plugin that allows unauthenticated attackers to bypass administrator account protections and achieve account takeover. The vulnerability exists in the front-end Forms module's update-user action, where authorization validation and execution occur at different stages without consistent target resolution. This creates a critical window where an attacker can manipulate the intended target between permission checks and action execution, effectively allowing them to hijack administrative accounts and gain full site control. Any WordPress installation using versions 0.9.2.8 or earlier of this popular plugin—which extends ACF's custom field capabilities—is at risk of complete compromise, affecting site owners, administrators, and all users whose data could be exposed through administrator account takeover.

Casky's 224 mapped security skills enable practitioners to detect the attack patterns underlying this vulnerability by analyzing privilege escalation techniques (TA0004 - Privilege Escalation) through extended reasoning with Claude AI. Practitioners using the platform would identify behavioral indicators such as: (1) update-user requests from unauthenticated sessions targeting administrator accounts, (2) inconsistencies between authorization context and execution context in ACF form submissions, (3) rapid sequential requests to user-update endpoints with parameter variations, and (4) successful session issuance immediately following user update operations from external sources. The platform's skill coverage maps techniques like Account Manipulation and Exploitation of TOCTOU conditions, allowing security teams to correlate suspicious form submissions, unusual administrative account modifications, and unauthorized session creation as part of a coordinated exploitation chain. Practitioners would see findings flagging authentication bypass attempts and privilege boundary violations specific to WordPress plugin behavior.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94268.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-94268

Casky has 224 skills that investigate the attack patterns behind CVE-2026-94268. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn