Advisory · CVE-2026-120534
ACF Extended PRO limited code injection via render_field
ACF Extended PRO up to and including 0.9.2.6 lets unauthenticated attackers call arbitrary WordPress functions with controlled arguments through insufficiently validated form configuration in render_field.
- Vendor
- ACF Extended
- Product
- ACF Extended PRO
- Identifier / CWE
- CVE-2026-120534
CWE-434 - Action timing
- Immediate
Explain it like I’m five
A form is supposed to show fields, but this one takes its display instructions and hands them straight to a function caller without checking them. An attacker can slip in the name of any WordPress function plus the arguments to run with it.
- 01Crafted form configuration
An unauthenticated attacker reaches a form rendered by ACF Extended with crafted configuration parameters.
- 02Validation skipped
The render_field method merges form configuration parameters into field settings without sufficient validation.
- 03Function call dispatched
The merged settings reach a call that invokes a function by name with attacker-controlled arguments.
- 04Arbitrary function runs
The chosen WordPress function executes in the site context, which can escalate to full site compromise depending on the function called.
What happened
ACF Extended PRO versions up to and including 0.9.2.6 contain a limited code injection vulnerability in the render_field function. Insufficient validation of form configuration parameters before merging them into field settings and passing them to a function call lets unauthenticated attackers call arbitrary WordPress functions with controlled arguments. The record rates it critical at CVSS 9.8.
Two preconditions narrow the reach, and both are worth checking: one attack method requires an administrator to have enabled the non-default shortcode_preview setting for the target form, while the other requires the server environment to lack OpenSSL functions, causing the plugin decryption helper to fall back to unverified base64 decoding. ACF Extended is a widely used companion to Advanced Custom Fields, with 100,000 active installs of its free listing per the WordPress.org plugin API, and the vendor changelog lists 0.9.2.8 as the current release, outside the stated affected range.
What to do
- Inventory WordPress sites running ACF Extended PRO and record each version.
- Update to the latest release, 0.9.2.8 or later, following the vendor changelog.
- Until updated, disable the shortcode_preview setting on forms where it is not needed, and confirm OpenSSL functions are available so decryption does not fall back to unverified base64 decoding.
- Review web logs for unusual form submissions or unexpected function calls on sites running affected versions.
- Verify the deployed version after updating, and investigate any site where exploitation cannot be excluded.
Management note
A display feature that turns configuration into function calls is a code execution primitive hiding in plain sight. The preconditions matter, but they are configuration details an attacker can probe for, so treat the update as urgent on any site running the affected versions.