---
id: "CVE-2026-120534"
kind: "vulnerability"
aliases: ["CVE-2026-120534"]
title: "ACF Extended PRO (WordPress) <= 0.9.2.6: unauthenticated attackers can call arbitrary WordPress functions, fixed in 0.9.2.7"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "acf-extended-pro", "fixed": ["0.9.2.7"], "affected": "<= 0.9.2.6", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["acf-extended-pro", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "newer-version"]
published_at: "2026-11-03T05:18:31+00:00"
first_seen_at: "2026-11-03T05:48:52+00:00"
updated_at: "2026-11-03T05:51:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120534", "first_seen_at": "2026-11-03T05:48:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T05:51:01+00:00"}]
---

# ACF Extended PRO (WordPress) <= 0.9.2.6: unauthenticated attackers can call arbitrary WordPress functions, fixed in 0.9.2.7

The Advanced Custom Fields: Extended PRO plugin for WordPress passes unvalidated form configuration into call_user_func_array, through the render_field function. An unauthenticated attacker can call arbitrary WordPress functions with chosen arguments, which can lead to code execution on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:acf-extended-pro affected <= 0.9.2.6 fixed 0.9.2.7

## How to check

- In WP Admin > Plugins, or with 'wp plugin list', check whether ACF Extended PRO is installed and its version is 0.9.2.6 or lower.
- Check whether the non-default 'shortcode_preview' setting is enabled on any ACFE form (Method 1).
- Check whether PHP on the server lacks the OpenSSL extension ('php -m' should list openssl); if it is missing, ACF Pro's acf_decrypt falls back to unverified base64 decoding (Method 2).
- Also check the free ACF Extended (Basic) plugin: it is a separate product with its own recent RCE fixes (0.9.2.8), not covered by this CVE.

## Fix

Update ACF Extended PRO to 0.9.2.7 or later (latest 0.9.2.8, released 19/10/2026). The vendor changelog for 0.9.2.7 lists 'Fixed security issue with shortcode preview' for Pro.

## Timeline

- 2026-11-03T05:48:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120534
- 2026-11-03T05:51:01+00:00 analyst — Vendor changelog 0.9.2.7 (acf-extended.com) says Pro fixed a shortcode preview security issue; the fix version 0.9.2.7 for this CVE is from WordSec (secondary), the changelog does not cite the CVE or the OpenSSL-fallback method, so nothing marked verified. No exploitation or PoC found. Wordfence CVSS 9.8, disclosed 2026-09-14.

## Documents

- [describes] WordSec: ACF Extended PRO <= 0.9.2.6 RCE, patched in 0.9.2.7 https://wordsec.net/vulnerabilities/plugins/acf-extended-pro/advanced-custom-fields-extended-pro-0926-unauthenticated-remote-code-execution-via-dynamic-render-field-type
- [fix] ACF Extended changelog 0.9.2.7 (27/08/2026) https://www.acf-extended.com/changelog/0-9-2-7

## From the sources

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_