{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/advanced-custom-fields-extended-pro--0.9.2.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:advancedcustomfields:extended_pro:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-120534"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Advanced Custom Fields: Extended PRO (\u003c= 0.9.2.6)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","plugin","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Advanced Custom Fields"],"content_html":"\u003cp\u003eCVE-2026-120534 identifies a vulnerability in Advanced Custom Fields: Extended PRO for WordPress in all versions up to, and including, 0.9.2.6. The flaw exists in the 'render_field' function due to insufficient validation of form configuration parameters before they are merged into field settings and passed to 'call_user_func_array'.\u003c/p\u003e\n\u003cp\u003eThis vulnerability allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments, contingent on specific conditions:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eThe administrator has enabled the non-default 'shortcode_preview' setting for the target form.\u003c/li\u003e\n\u003cli\u003eThe server environment lacks OpenSSL functions, causing 'acf_decrypt' to fall back to unverified base64 decoding.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-03T05:54:31Z","date_published":"2026-11-03T05:54:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-acf-extended-pro-code-injection/","summary":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.","title":"Advanced Custom Fields: Extended PRO: Limited Code Injection (CVE-2026-120534)","url":"https://feed.craftedsignal.io/briefs/2026-11-acf-extended-pro-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Advanced Custom Fields: Extended PRO (\u003c= 0.9.2.6)","version":"https://jsonfeed.org/version/1.1"}