ACF Extended vulnerabilities and threats

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

CVE-2026-112313 is a high-severity stored cross-site scripting (XSS) vulnerability in ACF Extended versions before 0.9.2.8. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 0.9.2.8.

CVE-2026-112311 is a path traversal vulnerability in ACF Extended versions prior to 0.9.2.8. This flaw allows attackers to bypass directory restrictions and potentially access or modify files outside the intended directory. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-112312 is a Missing Authorization vulnerability in ACF Extended versions prior to 0.9.2.8. It allows unauthorized network attackers to exploit incorrectly configured access control security levels, leading to high confidentiality impact without requiring privileges or user interaction. The issue is fixed in version 0.9.2.8.