Unauthenticated attackers can execute code on the server by exploiting a vulnerability in the Advanced Custom Fields: Extended WordPress plugin.
Affected component: Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO (plugin)
Fixed in: 0.9.2.8 (Advanced Custom Fields: Extended), 0.9.2.8 (Advanced Custom Fields: Extended PRO)
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 29, 2026. No PowerSEC firewall rule blocks this attack. Update each affected component to its fixed version to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-94267