SECURITYCRITICALCVE-2026-120534

CVE-2026-120534 — Advanced Custom Fields: Extended PRO Code Injection

Critical (CVSS 9.8) limited code injection in ACF Extended PRO for WordPress via render_field, affecting versions 0.9.2.6 and earlier.

Dylan H.

Security Team

November 3, 2026
2 min read
CVE-2026-120534 — Advanced Custom Fields: Extended PRO Code Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Advanced Custom Fields: Extended PRO plugin for WordPress, versions 0.9.2.6 and earlier

Executive Summary

CVE-2026-120534 is a critical (CVSS 3.1: 9.8) limited code injection flaw in the Advanced Custom Fields: Extended PRO WordPress plugin. All versions up to and including 0.9.2.6 are affected. The CVE was published on November 3, 2026, with Wordfence as the CNA.

Vulnerability Details

The render_field function merges form configuration parameters into field settings without sufficient validation, then passes them to call_user_func_array. An unauthenticated attacker can cause arbitrary WordPress functions to be called with attacker-controlled arguments. The weakness is classified as CWE-94 (code injection), with CWE-434 also referenced by some trackers.

The attack is network-based, low complexity, and requires no privileges or user interaction. However, public analysis indicates exploitation depends on specific conditions:

  • Method 1: an administrator has enabled the non-default shortcode_preview setting for the targeted form
  • Method 2: the server lacks OpenSSL functions, causing the ACF Pro acf_decrypt routine to fall back to unverified base64 decoding

Sites that meet neither condition have a smaller practical exposure, but should still be treated as vulnerable until patched.

Impact

Calling arbitrary WordPress functions with chosen arguments can allow privilege escalation (for example creating administrator accounts or changing options), content manipulation, and in some chains remote code execution.

Status

  • No fixed version was identified in the available sources
  • Not in CISA KEV; no confirmed in-the-wild exploitation or public exploit code was found. Some threat-intel feeds report conflicting honeypot data
  • NVD analysis status is currently deferred

Remediation

  1. Identify installations: wp plugin list | grep -i acf
  2. Upgrade to any release newer than 0.9.2.6 as soon as one is published (check the plugin changelog and Wordfence)
  3. Until patched, disable the shortcode_preview setting on all forms and confirm PHP has the OpenSSL extension loaded
  4. Consider deactivating the plugin on internet-facing sites that do not strictly need it
  5. Audit for unexpected administrator accounts, modified options, and new plugins or files

References