ACF Extended
CVE-2026-120534: The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the rend
CVE-2026-120534 Nov 3, 2026 Source: Vendor
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administra
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-120534
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-120534
BR2026-0000-041490
unclaimed
Credited as Tin Pham (TF1T)
CVE-2026-120534
BR2026-0000-041491
unclaimed
Credited as Trong Pham (dtro)
CVE-2026-120534
BR2026-0000-041492
unclaimed
Credited as Hao Ngo