Read the docs
TI-2026-79605 Aliases CVE-2026-94263GHSA-p7mg-pc34-v9p7

Unauthenticated shortcode execution in Advanced Custom Fields: Extended

Priority LOW 21CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 before 0.9.2.8 do not consistently disable shortcode processing in the confirmation message of front-end forms. Unauthenticated visitors can have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting, a case of improper neutralization (CWE-74). The CVSS 3.1 vector rates the attack as high complexity with no privileges or user interaction required, with low confidentiality and integrity impact. No exploitation is listed in CISA KEV, but the references link a public exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced Custom Fields: Extended (Unknown): 0.9.2.8Advanced Custom Fields: Extended PRO (Unknown): 0.9.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced Custom Fields: Extended0.9.2.4 to before 0.9.2.80.9.2.8Patch availableCNA
UnknownAdvanced Custom Fields: Extended PRO0.9.2.4 to before 0.9.2.80.9.2.8Patch availableCNA
  • Advanced Custom Fields: Extended VendorUnknown Affected 0.9.2.4 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA
  • Advanced Custom Fields: Extended PRO VendorUnknown Affected 0.9.2.4 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA

Remediation

Update Advanced Custom Fields: Extended to version 0.9.2.8 and Advanced Custom Fields: Extended PRO to version 0.9.2.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Advanced Custom Fields: Extended (Unknown) Fixed in 0.9.2.8
  • Fix · CNA Advanced Custom Fields: Extended PRO (Unknown) Fixed in 0.9.2.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO 0.9.2.8

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79558 Unauthenticated code execution in Advanced Custom Fields: ExtendedPriority MEDIUM 41
    • TI-2026-79559 Privilege management flaw in Advanced Custom Fields: Extended pluginsPriority LOW 37
    • TI-2026-79556 Account takeover in Advanced Custom Fields: Extended front-end formsPriority LOW 37
    Show all 5 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-94263
  2. 2026-10-23 Alias added: GHSA-p7mg-pc34-v9p7

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences