CVE-2026-120534
Deferred Deferred - Pending Action

Limited Code Injection in Advanced Custom Fields Extended PRO

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Wordfence

Description
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ACF Extended Advanced Custom Fields: Extended PRO 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a limited code injection flaw in the Advanced Custom Fields: Extended PRO WordPress plugin affecting versions up to 0.9.2.6. It occurs due to insufficient validation of form configuration parameters in the render_field function. Attackers can exploit this to call arbitrary WordPress functions with controlled arguments without authentication.

Detection Guidance

Check if the Advanced Custom Fields: Extended PRO plugin version is 0.9.2.6 or lower. Inspect WordPress logs for unusual function calls or unauthorized actions. Look for signs of the 'shortcode_preview' setting being enabled in plugin configurations.

Impact Analysis

An attacker could exploit this to execute malicious code on your WordPress site, potentially taking full control of it. This could lead to data theft, defacement, or spreading malware to visitors. The attack requires either admin-enabled settings or a server without OpenSSL functions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. A successful exploit may result in data breaches, triggering compliance violations and potential fines.

Mitigation Strategies

Update the Advanced Custom Fields: Extended PRO plugin to version 0.9.2.8 or higher immediately. Disable the 'shortcode_preview' setting if enabled. Ensure OpenSSL functions are available on the server to prevent fallback to unverified base64 decoding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...