CVE-2026-94263: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Advanced Custom Fields: Extended

The Advanced Custom Fields: Extended and its PRO variant WordPress plugins from versions 0.9.2.4 to 0.9.2.7 have a weakness where shortcode processing is not reliably disabled in the confirmation message of front-end forms. This improper neutralization of special elements (shortcodes) can lead to arbitrary shortcode execution on the server side when an unauthenticated visitor submits a form with a vulnerable configuration setting. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

An unauthenticated attacker can cause arbitrary shortcodes to be executed server-side, potentially leading to limited confidentiality and integrity impacts. The CVSS score of 4.8 (medium severity) reflects that the attack requires network access with high attack complexity and no privileges or user interaction, resulting in low confidentiality and integrity impacts and no availability impact.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review and disable shortcode processing in confirmation messages of front-end forms where possible or avoid using affected plugin versions.