CVE-2026-8809: ACF Extended Unauthenticated Privilege Escalation (CVSS 9.8)

CVE-2026-8809 (CVSS 9.8) — unauthenticated privilege escalation in ACF Extended <= 0.9.2.5 lets any visitor create a WordPress administrator account.