{"id":"CVE-2026-94263","kind":"vulnerability","aliases":["CVE-2026-94263"],"related":[],"title":"WordPress ACF Extended: unauthenticated shortcode execution through form confirmation messages","description":"The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.","summary":"The Advanced Custom Fields: Extended and Extended PRO WordPress plugins, versions 0.9.2.4 through 0.9.2.7, do not consistently disable shortcode processing in front-end form confirmation messages. An unauthenticated visitor who submits a form whose stored configuration lacks the setting can get arbitrary shortcodes run on the server.","severity":"medium","cvss":4.8,"epss":0.00229,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-public-forms","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get acf-extended --field=version` (plugin slug unknown; confirm in the sources)\n- Review front-end forms built with the plugin for a confirmation message that is not set to disable shortcodes","fix":"- Update Advanced Custom Fields: Extended and Extended PRO to a version later than `0.9.2.7` (exact fixed version unknown)","status":"open","published_at":"2026-10-23T12:18:19+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:33:02+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:33:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update Advanced Custom Fields: Extended and Extended PRO to a version later than `0.9.2.7` (exact fixed version unknown)","reach":"internet","title":"WordPress ACF Extended: unauthenticated shortcode execution through form confirmation messages","impact":"medium","summary":"The Advanced Custom Fields: Extended and Extended PRO WordPress plugins, versions 0.9.2.4 through 0.9.2.7, do not consistently disable shortcode processing in front-end form confirmation messages. An unauthenticated visitor who submits a form whose stored configuration lacks the setting can get arbitrary shortcodes run on the server.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary shortcodes execute on the server when a visitor submits a form","analyst_note":"Confirm the fixed version and plugin slug from the NVD entry or the vendor changelog, and check which stored form settings trigger the flaw.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get acf-extended --field=version` (plugin slug unknown; confirm in the sources)\n- Review front-end forms built with the plugin for a confirmation message that is not set to disable shortcodes","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-public-forms"],"who_is_affected":"Sites running Advanced Custom Fields: Extended or Extended PRO at versions 0.9.2.4 through 0.9.2.7 that expose front-end forms built with the plugin. The exposure depends on the stored form configuration not carrying the setting that disables shortcodes. Sites without these plugins or without public front-end forms can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":3373,"output_tokens":675,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-94263':13A,16A '0.9.2.4':36B,87C '0.9.2.7':38B,89C 'acf':2A 'advanc':26B,74C,79C 'allow':106C 'arbitrari':67B,111C 'carri':127C 'configur':61B,124C 'confirm':9A,50B,98C 'consist':41B,92C 'custom':27B,75C,80C 'cve':11A,14A 'disabl':42B,93C 'end':48B,104C 'execut':6A,113C 'extend':3A,29B,31B,77C,82C 'field':28B,76C,81C 'form':8A,49B,58B,105C,121C 'front':47B,103C 'front-end':46B,102C 'get':66B 'host':20B 'lack':62B 'messag':10A,51B,99C 'packag':17B 'plugin':24B,34B,85C 'pro':32B,83C 'process':44B,95C 'relev':129C 'run':69B 'self':19B 'self-host':18B 'server':72B,115C 'server-sid':114C 'set':64B,130C 'shortcod':5A,43B,68B,94C,112C 'side':116C 'store':60B,123C 'submit':56B,119C 'unauthent':4A,53B,107C 'version':35B 'visitor':54B,108C 'whose':59B,122C 'wordpress':1A,21B,23B,33B,84C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running Advanced Custom Fields: Extended or Extended PRO at versions 0.9.2.4 through 0.9.2.7 that expose front-end forms built with the plugin. The exposure depends on the stored form configuration not carrying the setting that disables shortcodes. Sites without these plugins or without public front-end forms can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94263","severity":null,"published_at":"2026-10-23T12:18:19+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94263","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94263","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}