Read the docs
TI-2026-83241 Aliases CVE-2026-110305GHSA-6gvj-qmj9-cj2m

Advanced Custom Fields: Extended exposes user password hashes

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The hwk-fr Advanced Custom Fields: Extended WordPress plugin through 0.9.2.7 exposes sensitive information (CWE-200). Input mapped to a term name is resolved as a template tag and saved as a publicly readable term name. An unauthenticated remote attacker can read the WordPress password hash of any user when an administrator has configured a public acfe_form page with a Term action using a save.name field mapping.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. Exploitation requires that an administrator has configured a public [acfe_form] shortcode page with a Term action using a save.name field mapping — a supported and documented configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00613 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hwk-frAdvanced Custom Fields: Extendedup to 0.9.2.7—No fix listedCNA
  • Advanced Custom Fields: Extended Vendorhwk-fr Affected up to 0.9.2.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Advanced Custom Fields: Extended.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-110305
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Alias added: GHSA-6gvj-qmj9-cj2m
  5. 2026-11-01 Priority changed: LOW → MEDIUM

References

Other 9

  • TI-2025-12329 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form CVSS 3.1CRITICAL 9.8
  • TI-2025-13276 Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action CVSS 3.1CRITICAL 9.8
  • TI-2026-07743 Improper privilege management in hwk-fr Advanced Custom Fields: Extended CVSS 3.1CRITICAL 9.8
  • TI-2025-14104 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1MEDIUM 6.5
  • TI-2024-21446 WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2026-81718 Missing authorization in Advanced Custom Fields: Extended CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences