CVE-2026-120534: Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

Q: Which installations are affected?

All versions of Advanced Custom Fields: Extended PRO up to and including 0.9.2.6 are affected. Exploitation can be performed remotely without authentication or user interaction when the relevant method prerequisites are present.

Q: Is a default configuration affected?

One exploitation method requires the administrator to enable the non-default shortcode_preview setting for the target form. A second method instead depends on the server lacking OpenSSL functions, which causes ACF Pro decryption to fall back to unverified base64 decoding.

Q: What does an attacker need to exploit this?

The attacker does not need an account or user interaction. They need either a target form with shortcode_preview enabled, or a server environment without OpenSSL functions, depending on the exploitation method used.

Q: How can administrators assess exposure?

Verify whether the installed plugin version is 0.9.2.6 or earlier. For the first method, inspect target forms for the shortcode_preview setting; for the second, determine whether the server has OpenSSL functions available.

Q: What is the security impact?

An attacker can control form configuration parameters that are merged into field settings and passed to call_user_func_array. This can allow calls to arbitrary WordPress functions with controlled arguments, resulting in limited code injection.

Published Nov 3, 2026

Updated

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the renderfield function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to calluserfuncarray in the renderfield method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcodepreview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acfdecrypt to fall back to unverified base64 decoding.

Event History

Nov 3, 2026

CVE Published

via MITRE·04:43 AM

Data Sourced

via MITRE·04:43 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

All versions of Advanced Custom Fields: Extended PRO up to and including 0.9.2.6 are affected. Exploitation can be performed remotely without authentication or user interaction when the relevant method prerequisites are present.

Is a default configuration affected?

One exploitation method requires the administrator to enable the non-default shortcode_preview setting for the target form. A second method instead depends on the server lacking OpenSSL functions, which causes ACF Pro decryption to fall back to unverified base64 decoding.

What does an attacker need to exploit this?

The attacker does not need an account or user interaction. They need either a target form with shortcode_preview enabled, or a server environment without OpenSSL functions, depending on the exploitation method used.

How can administrators assess exposure?

Verify whether the installed plugin version is 0.9.2.6 or earlier. For the first method, inspect target forms for the shortcode_preview setting; for the second, determine whether the server has OpenSSL functions available.

What is the security impact?

An attacker can control form configuration parameters that are merged into field settings and passed to call_user_func_array. This can allow calls to arbitrary WordPress functions with controlled arguments, resulting in limited code injection.

CVE-2026-120534: Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

Event History

Frequently Asked Questions

Which installations are affected?

Is a default configuration affected?

What does an attacker need to exploit this?

How can administrators assess exposure?

What is the security impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Is a default configuration affected?

What does an attacker need to exploit this?

How can administrators assess exposure?

What is the security impact?