The vulnerability resides in the Advanced Custom Fields: Extended WordPress plugin, where insecure handling of user input in the form module allows an unauthenticated attacker to execute arbitrary shortcodes. Shortcodes can inject and run code that may perform malicious actions, such as data exfiltration, further code execution, or site defacement. This flaw falls under CWE-94, reflecting the lack of proper validation before invoking the do_shortcode function.

WordPress sites that have the Advanced Custom Fields: Extended plugin installed at any version up to and including 0.9.2.3 are affected. The vulnerability applies to all releases of the plugin prior to 0.9.2.4, regardless of other theme or plugin configurations.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available, which suggests limited data on exploitation likelihood. The plugin is not listed in the CISA KEV catalog, so no known widespread exploitation is reported at this time. Because the flaw can be triggered by any unauthenticated web request that processes a form submission, an attacker with internet access to the site could directly exploit the issue by crafting a form payload containing malicious shortcodes. No special privileges or authenticated access are required for exploitation.