CVE-2026-94263: Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO versions 0.9.2.4 through 0.9.2.7 are affected when they have front-end forms whose stored configuration lacks the setting that disables shortcode processing in the confirmation message.
Does exploitation require an authenticated WordPress account or user interaction?
No. An unauthenticated visitor can trigger the issue by submitting an affected front-end form; no authenticated account or separate user interaction is required.
What must an attacker be able to do to exploit the vulnerability?
The attacker needs access to submit a vulnerable front-end form. Exploitation also depends on the form's stored configuration not carrying the relevant shortcode-processing disablement setting.