CVE-2026-94263mediumCWE-74

CVE-2026-94263: medium-severity vulnerability in Advanced Custom Fields: Extended

Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

Published

Follow this CVE+ Monitor Advanced Custom Fields: Extended+ Monitor Advanced Custom Fields: Extended PRO

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.8epss 0.2%
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Advanced Custom Fields: ExtendedUnknown · Advanced Custom Fields: Extended PRO
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Advanced Custom Fields: Extended

In the same product, most dangerous first.

CVE-2021-24865—Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionEPSS 1.5%CVE-2026-94267CRITICALAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionEPSS 0.4%CVE-2026-80467HIGHAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert ActionEPSS 0.4%CVE-2026-12526HIGHAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.4%CVE-2026-94268HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%CVE-2026-94264MEDIUMAdvanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode AttributesEPSS 0.3%