Live › vulnerability › CVE-2026-112311
Go to dashboardACF Extended, a WordPress plugin that extends Advanced Custom Fields, has a path traversal flaw in versions through 0.9.2.7. The sources do not say what file an attacker can reach or whether the attack needs a logged-in account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running ACF Extended at version or older are in the affected range. The sources do not say which feature or request path is vulnerable, so whether a given site is reachable is unknown.
0.9.2.7No product ranges from the sources yet.
wp plugin get acf-extended --field=version0.9.2.7, if one is released; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-112311")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.