{"id":"CVE-2026-120534","kind":"vulnerability","aliases":["CVE-2026-120534"],"related":[],"title":"ACF Extended PRO (WordPress) <= 0.9.2.6: unauthenticated attackers can call arbitrary WordPress functions, fixed in 0.9.2.7","description":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.","summary":"The Advanced Custom Fields: Extended PRO plugin for WordPress passes unvalidated form configuration into call_user_func_array, through the render_field function. An unauthenticated attacker can call arbitrary WordPress functions with chosen arguments, which can lead to code execution on the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"acf-extended-pro","fixed":["0.9.2.7"],"affected":"<= 0.9.2.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["acf-extended-pro","package","self-hosted","wordpress"],"not_affected_if":["default-config","newer-version"],"how_to_check":"- In WP Admin > Plugins, or with 'wp plugin list', check whether ACF Extended PRO is installed and its version is 0.9.2.6 or lower.\n- Check whether the non-default 'shortcode_preview' setting is enabled on any ACFE form (Method 1).\n- Check whether PHP on the server lacks the OpenSSL extension ('php -m' should list openssl); if it is missing, ACF Pro's acf_decrypt falls back to unverified base64 decoding (Method 2).\n- Also check the free ACF Extended (Basic) plugin: it is a separate product with its own recent RCE fixes (0.9.2.8), not covered by this CVE.","fix":"Update ACF Extended PRO to 0.9.2.7 or later (latest 0.9.2.8, released 19/10/2026). The vendor changelog for 0.9.2.7 lists 'Fixed security issue with shortcode preview' for Pro.","status":"open","published_at":"2026-11-03T05:18:31+00:00","first_seen_at":"2026-11-03T05:48:52+00:00","triaged_at":"2026-11-03T05:49:46+00:00","updated_at":"2026-11-03T05:51:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T05:49:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress ACF Extended PRO plugin: unauthenticated attackers call arbitrary WordPress functions","impact":"high","summary":"The Advanced Custom Fields: Extended PRO plugin for WordPress passes unvalidated form configuration into call_user_func_array, through the render_field function. An unauthenticated attacker can call arbitrary WordPress functions with chosen arguments, which can lead to code execution on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","acf-extended-pro","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker calls arbitrary WordPress functions with chosen arguments","analyst_note":"Find the fixed version and vendor advisory for ACF Extended PRO; the sources do not name a patched release.","how_to_check":"- Check whether the Advanced Custom Fields: Extended PRO plugin is installed and its version is `0.9.2.6` or lower.\n- Check whether the non-default 'shortcode_preview' setting is enabled on any form.\n- Check whether the server's OpenSSL functions are missing, since that enables the second method.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","newer-version"],"who_is_affected":"Sites running the Advanced Custom Fields: Extended PRO plugin at version 0.9.2.6 or earlier are exposed. The first method needs the non-default 'shortcode_preview' setting enabled on the target form, and the second needs a server without OpenSSL functions, so sites with neither may be less exposed. The sources do not say which versions are fixed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4269,"output_tokens":638,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed version and vendor advisory for ACF Extended PRO; the sources do not name a patched release.","search":"'-120534':18A,21A '-2026':17A,20A '0.9.2.6':5A,100C '0.9.2.7':15A '1':149C '2':168C 'acf':1A,23A,27B,178C,181C 'acf-extended-pro':22A,26B 'administr':152C 'advanc':36B,79C 'arbitrari':10A,63B,142C 'argument':68B,147C 'array':52B,127C 'attack':7A,60B,139C 'back':185C 'base64':188C 'call':9A,49B,62B,124C,141C 'caus':177C 'chosen':67B 'code':73B,91C 'configur':47B,114C 'control':146C 'custom':37B,80C 'cve':16A,19A 'decod':189C 'decrypt':182C 'default':158C 'due':108C 'enabl':154C 'environ':172C 'execut':74B 'extend':2A,28B,39B,82C 'extended':24A 'fall':184C 'field':38B,56B,81C,104C,119C,131C 'fix':13A 'form':46B,113C,165C 'func':51B,126C 'function':12A,57B,65B,105C,144C,176C 'host':33B 'includ':99C 'inject':92C 'insuffici':110C 'lack':174C 'lead':71B 'limit':90C 'make':134C 'merg':117C 'method':132C,148C,167C 'non':157C 'non-default':156C 'openssl':175C 'packag':30B 'paramet':115C 'pass':44B,122C 'plugin':41B,84C 'possibl':136C 'preview':160C 'pro':3A,25A,29B,40B,83C,179C 'render':55B,103C,130C 'requir':150C,169C 'self':32B 'self-host':31B 'server':171C 'set':120C,161C 'shortcod':159C 'site':77B 'target':164C 'unauthent':6A,59B,138C 'unvalid':45B 'unverifi':187C 'user':50B,125C 'valid':111C 'version':95C 'via':101C 'vulner':88C 'wordpress':4A,11A,34B,43B,64B,86C,143C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Custom Fields: Extended PRO plugin at version 0.9.2.6 or earlier are exposed. The first method needs the non-default 'shortcode_preview' setting enabled on the target form, and the second needs a server without OpenSSL functions, so sites with neither may be less exposed. The sources do not say which versions are fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["acfextendedpro"],"ptokens":["acf","extended","pro"],"labels":["acfextendedpro","critical","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T05:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120534","severity":null,"published_at":"2026-11-03T05:18:31+00:00","modified_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:52+00:00","fetched_at":"2026-11-03T05:48:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120534:1454","url":null,"severity":null,"published_at":"2026-11-03T05:51:01+00:00","modified_at":"2026-11-03T05:51:01+00:00","first_seen_at":"2026-11-03T05:51:01+00:00","fetched_at":"2026-11-03T05:51:01+00:00","note":"Vendor changelog 0.9.2.7 (acf-extended.com) says Pro fixed a shortcode preview security issue; the fix version 0.9.2.7 for this CVE is from WordSec (secondary), the changelog does not cite the CVE or the OpenSSL-fallback method, so nothing marked verified. No exploitation or PoC found. Wordfence CVSS 9.8, disclosed 2026-09-14."}],"documents":[{"id":55850,"url":"https://www.acf-extended.com/changelog/0-9-2-7","title":"ACF Extended changelog 0.9.2.7 (27/08/2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":55851,"url":"https://wordsec.net/vulnerabilities/plugins/acf-extended-pro/advanced-custom-fields-extended-pro-0926-unauthenticated-remote-code-execution-via-dynamic-render-field-type","title":"WordSec: ACF Extended PRO <= 0.9.2.6 RCE, patched in 0.9.2.7","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}