Blog · 2-hour update · 2026-10-23

CVE-2026-94267 Advanced Custom Fields: critical remote flaw, how to fix

On 23 October 2026, 20 new CVEs were published that we track: 1 critical, 0 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Patch these first

CVE-2026-94267: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor

Critical severity (CVSS 9.0), priority 39/100 (patch this month). Signals: critical severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-94268: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor

High severity (CVSS 8.1), priority 35/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-94262: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor

High severity (CVSS 8.1), priority 34/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-109936: The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dyna

High severity (CVSS 7.5), priority 28/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-113499: The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to styl

High severity (CVSS 7.5), priority 28/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-113500: The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to styl

High severity (CVSS 7.5), priority 28/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-111982: The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the

High severity (CVSS 7.2), priority 26/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-109933: The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styl

Medium severity (CVSS 6.8), priority 25/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 23 October 2026?

CVE-2026-94267 (The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor) ranks highest, with a priority score of 39/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

← All posts