Advanced Custom Fields: Extended PRO (<= 0.9.2.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/advanced-custom-fields-extended-pro--0.9.2.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 05:54:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdvanced Custom Fields: Extended PRO: Limited Code Injection (CVE-2026-120534)https://feed.craftedsignal.io/briefs/2026-11-acf-extended-pro-code-injection/Tue, 03 Nov 2026 05:54:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-acf-extended-pro-code-injection/The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.CVE-2026-120534 identifies a vulnerability in Advanced Custom Fields: Extended PRO for WordPress in all versions up to, and including, 0.9.2.6. The flaw exists in the 'render_field' function due to insufficient validation of form configuration parameters before they are merged into field settings and passed to 'call_user_func_array'.

This vulnerability allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments, contingent on specific conditions:

  1. The administrator has enabled the non-default 'shortcode_preview' setting for the target form.
  2. The server environment lacks OpenSSL functions, causing 'acf_decrypt' to fall back to unverified base64 decoding.
]]>criticaladvisorywordpresspluginvulnerability