Live › vulnerability › CVE-2026-120534
The Advanced Custom Fields: Extended PRO plugin for WordPress passes unvalidated form configuration into call_user_func_array, through the render_field function. An unauthenticated attacker can call arbitrary WordPress functions with chosen arguments, which can lead to code execution on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running the Advanced Custom Fields: Extended PRO plugin at version 0.9.2.6 or earlier are exposed. The first method needs the non-default 'shortcode_preview' setting enabled on the target form, and the second needs a server without OpenSSL functions, so sites with neither may be less exposed. The sources do not say which versions are fixed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| acf-extended-pro | wordpress | <= 0.9.2.6 | 0.9.2.7 |
0.9.2.7 or later (latest 0.9.2.8, released 19/10/2026)0.9.2.7 lists Fixed security issue with shortcode preview for ProEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.
This page as .md · .json · in your agent: get_signal("CVE-2026-120534")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.