Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by WPScan

CVE-2026-94263Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

Medium 4.8

In plain English

A medium-severity injection in Advanced Custom Fields: Extended from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Affected products (as reported)

VendorProductVersions
Unknown Advanced Custom Fields: Extended 0.9.2.4 – before 0.9.2.8
Unknown Advanced Custom Fields: Extended PRO 0.9.2.4 – before 0.9.2.8

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References