hwk-fr Advanced Custom Fields: Extended

• CVE-2026-110305 High 7.5 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection 0.6%
• CVE-2026-2839 Medium 5.3 Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints 0.3%
• CVE-2026-10752 Medium 4.8 Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field 0.3%
• CVE-2026-8809 Critical 9.8 Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter 0.8%
• CVE-2025-15463 Medium 6.5 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution 0.4%
• CVE-2025-14533 Critical 9.8 Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action 1.5%
• CVE-2025-13486 Critical 9.8 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form 68.6%
• CVE-2023-5292 Medium 6.4 Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%