CVE-2026-120534— Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

Quick assessment

Affected

ACF Extended Advanced Custom Fields: Extended PRO

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"Advanced Custom Fields: Extended PRO"插件在所有 0.9.2.6 及之前的版本中，存在通过函数触发的有限代码注入漏洞。该漏洞源于在将表单配置参数合并到字段设置并传递给方法中的之前，未对这些参数进行充分验证。这导致未认证的攻击者能够使用受控参数调用任意的 WordPress 函数。触发方式有两种：方法一：需要管理员在目标表单中启用非默认的设置；方法二：要求服务器环境缺少 OpenSSL 函数，导致 ACF Pro 的函数退化为未经验证的 Ba

CVSS 9.8 · Critical Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

Source: CVE Program / CVE List V5

Vulnerability Description

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ACF Extended	Advanced Custom Fields: Extended PRO	0 ~ 0.9.2.6	-

II. Public POCs for CVE-2026-120534

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120534

请登录查看更多情报信息。

Other References for CVE-2026-120534 (2)

https://www.cve.org/CVERecord?id=CVE-2026-120534

IV. Related Vulnerabilities

Same vendor: ACF Extended

Same weakness: CWE-434