Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
Priority LOW 35CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00381 32nd percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15463
- 2026-10-03 Alias added: GHSA-7qqg-rvf9-85ww
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f8544784-1994-47e2-be39-568d0ab9ee00?source=cve
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.2/includes/modules/form/module-form-action-email.php#L111
- https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.9.2.2/includes/modules/form/module-form-front-render.php#L35
More hwk-fr vulnerabilities
- TI-2025-12329 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form CVSS 3.1CRITICAL 9.8
- TI-2025-13276 Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action CVSS 3.1CRITICAL 9.8
- TI-2026-07743 Improper privilege management in hwk-fr Advanced Custom Fields: Extended CVSS 3.1CRITICAL 9.8
- TI-2026-83241 Advanced Custom Fields: Extended exposes user password hashes CVSS 3.1HIGH 7.5
- TI-2024-21446 WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2026-81718 Missing authorization in Advanced Custom Fields: Extended CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-15463 · CVE Program
- CVE-2025-15463 · NVD
- FIRST EPSS
- GHSA-7qqg-rvf9-85ww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences