All vulnerabilities
CVE-2026-94263

Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

Unknown Advanced Custom Fields: Extended
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.9.2.8Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 0.9.2.8Advanced Custom Fields: ExtendedCVE List
  • 0.9.2.8Advanced Custom Fields: Extended PROCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Text from CVE List

Affected versions 2

  • Advanced Custom Fields: Extendedaffected: 0.9.2.4 before 0.9.2.8CVE List
  • Advanced Custom Fields: Extended PROaffected: 0.9.2.4 before 0.9.2.8CVE List

References 1