1 vulnerability across 1 product scored HIGH or above on November 03, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] acf_extended/advanced_custom_fields:_extended_pro

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:acf_extended:advanced_custom_fields_extended_pro:*:*:*:*:*:*:*:* (< 0.9.2.7)

ACF Extended Pro — Critical Code Injection Vulnerability

The Advanced Custom Fields: Extended PRO plugin for WordPress versions 0.9.2.6 and earlier contains a critical code injection vulnerability (CVE-2026-120534, CVSS 9.8) that allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments through the render_field method, due to insufficient validation of form configuration parameters. Any WordPress site running ACF Extended PRO should treat this as an urgent priority, as the flaw requires no authentication to exploit and could lead to full site compromise. Administrators should update immediately to a patched version by consulting the vendor changelog at https://www.acf-extended.com/changelog, and review server logs for signs of exploitation.

Vendor Advisory