The Advanced Custom Fields: Extended PRO plugin for WordPress has a limited code injection flaw in the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to inject arbitrary arguments into a call to call_user_func_array, enabling arbitrary WordPress functions to be executed with controlled arguments. This weakness, reflected in CWE‑434, can be leveraged for remote code execution.

WordPress sites running ACF Extended: Advanced Custom Fields: Extended PRO versions up to and including 0.9.2.6 are affected. Any earlier releases share the same flaw, as the vulnerability exists across all versions prior to the fix. Sites using these plugins must verify the installed version and identify affected form configurations.

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score is not available, so the precise exploitation probability cannot be quantified, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit the flaw through two methods: either by enabling the non‑default ‘shortcode_preview’ setting for a target form or by leveraging server environments lacking OpenSSL functions, which forces the plugin to fall back to unverified base64 decoding during field decryption. In either scenario, an unauthenticated attacker can invoke any WordPress function, potentially leading to full compromise of the site.