Summary
generated automatically from NVD dataThe Advanced Custom Fields: Extended PRO plugin for WordPress, in all versions up to and including 0.9.2.6, has a limited code injection flaw in its render_field function. Form configuration parameters are not properly validated before being merged into field settings and passed to call_user_func_array, so unauthenticated attackers can call arbitrary WordPress functions with controlled arguments. Exploitation requires either the non-default 'shortcode_preview' setting enabled on the target form, or a server lacking OpenSSL functions; the flaw is rated CVSS 9.8 (CRITICAL).
NVD description
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 3 nov. 2026
- Updated
- 3 nov. 2026
- Status
- Deferred
- Source
- security@wordfence.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-434
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.