Live › vulnerability › CVE-2026-110305
The Advanced Custom Fields: Extended plugin for WordPress, in versions up to and including 0.9.2.7, lets an unauthenticated visitor inject a {get_user} template tag into a public form so it is saved as a publicly readable term name. An attacker can read the WordPress password hash of any user, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Advanced Custom Fields: Extended plugin up to and including 0.9.2.7 where an administrator has published an [acfe_form] page with a Term action mapping save.name. Sites without that public form configuration are not exposed by this path. The sources do not say whether other configurations are affected.
No product ranges from the sources yet.
0.9.2.7 or earlier.[acfe_form] shortcode with a Term action that maps save.name.0.9.2.7 (the sources do not name the exact fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. Exploitation requires that an administrator has configured a public [acfe_form] shortcode page with a Term action using a save.name field mapping — a supported and documented configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-110305")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.