Advanced Custom Fields: Extended PRO: Limited Code Injection (CVE-2026-120534)
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.
CVE search metadata
CVE search record: CVE-2026-120534. Severity: critical. CVSS: 9.8. KEV: no. Product: Advanced Custom Fields: Extended PRO (<= 0.9.2.6). Brief: Advanced Custom Fields: Extended PRO: Limited Code Injection (CVE-2026-120534). Brief link: https://feed.craftedsignal.io/briefs/2026-11-acf-extended-pro-code-injection/
Triage facts
Revision 1- Applicability
- Advanced Custom Fields: Extended PRO (<= 0.9.2.6)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 05:54 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-120534 identifies a vulnerability in Advanced Custom Fields: Extended PRO for WordPress in all versions up to, and including, 0.9.2.6. The flaw exists in the 'render_field' function due to insufficient validation of form configuration parameters before they are merged into field settings and passed to 'call_user_func_array'.
This vulnerability allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments, contingent on specific conditions:
- The administrator has enabled the non-default 'shortcode_preview' setting for the target form.
- The server environment lacks OpenSSL functions, causing 'acf_decrypt' to fall back to unverified base64 decoding.