WordPress Advanced Custom Fields: Extended PRO Plugin <= 0.9.2.6 is vulnerable to a high priority Remote Code Execution (RCE)<\/p>
Software: Advanced Custom Fields: Extended PRO<\/p>
Fixed in version 0.9.2.7 <\/p>
Affected Version <= 0.9.2.6<\/p>
CVE: Unknown<\/p>","date":"2026-09-15"}],"impact":[]},{"uuid":"064a4f4ab90f30465da3589dff71dc2f778e9654a0d8dd0bdfc88d61545491ab","name":"Advanced Custom Fields: Extended PRO [acf-extended-pro] < 0.9.2.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"0.9.2.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-120534","name":"CVE-2026-120534","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-120534","description":"[en] The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.","date":"2026-11-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null}}}]},"updated":"1793770095"}