CVE-2026-120534Critical· 9.8▾ MidnightThe Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configurati…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.
advanced_custom_fields_extended_pro <= 0.9.2.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112313High· 7.1WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-112312High· 7.5WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability
CVE-2026-112311Medium· 6.5WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability
CVE-2025-14199Medium· 6.3A flaw has been found in Verysync 微力同步 up to 2.21.3
CVE-2025-11347High· 7.3A vulnerability was found in code-projects Student Crud Operation up to 3.3
CVE-2025-11318High· 7.3A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0