Live › vulnerability › CVE-2026-94263
Go to dashboardThe Advanced Custom Fields: Extended and Extended PRO WordPress plugins, versions 0.9.2.4 through 0.9.2.7, do not consistently disable shortcode processing in front-end form confirmation messages. An unauthenticated visitor who submits a form whose stored configuration lacks the setting can get arbitrary shortcodes run on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Advanced Custom Fields: Extended or Extended PRO at versions 0.9.2.4 through 0.9.2.7 that expose front-end forms built with the plugin. The exposure depends on the stored form configuration not carrying the setting that disables shortcodes. Sites without these plugins or without public front-end forms can skip it.
No product ranges from the sources yet.
wp plugin get acf-extended --field=version (plugin slug unknown; confirm in the sources)0.9.2.7 (exact fixed version unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
This page as .md · .json · in your agent: get_signal("CVE-2026-94263")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.