CVE-2026-110305
Deferred Deferred - Pending Action

Sensitive Information Exposure in Advanced Custom Fields Extended

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Wordfence

Description
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. Exploitation requires that an administrator has configured a public [acfe_form] shortcode page with a Term action using a save.name field mapping — a supported and documented configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-110305
EUVD
EUVD-2026-114215

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hwk-fr Advanced Custom Fields: Extended 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Advanced Custom Fields: Extended WordPress plugin up to version 0.9.2.7 has a flaw that allows unauthenticated attackers to access sensitive data. This happens when an administrator sets up a public page with a specific shortcode configuration that includes a Term action using a save.name field mapping. Attackers can inject a {get_user} template tag to extract sensitive information like WordPress password hashes of any user.

Detection Guidance

Check if the Advanced Custom Fields: Extended plugin version is up to 0.9.2.7 or lower. Look for public pages with [acfe_form] shortcodes configured with Term actions using save.name field mapping. Inspect term names for injected {get_user} template tags.

Impact Analysis

If you use the affected plugin version, attackers could steal password hashes of all users, including administrators. This could lead to unauthorized account access, data breaches, or further compromise of your WordPress site. The impact is significant as it requires no authentication and affects publicly accessible configurations.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face fines, legal penalties, and reputational damage due to non-compliance resulting from this exposure.

Mitigation Strategies

Update the Advanced Custom Fields: Extended plugin to the latest version. Remove any public [acfe_form] shortcode pages with Term actions using save.name field mapping. Review term names for unauthorized {get_user} template tags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart