Description
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
Published: 2026-10-23
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Arbitrary Shortcode Server‑Side Execution (Code Injection)
Action: Patch Application
AI Analysis

Impact

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from version 0.9.2.4 to 0.9.2.7 allow any visitor to submit a front‑end form without authentication, triggering the execution of arbitrary shortcodes that are embedded in the form confirmation message. Because shortcode processing is not consistently disabled, those shortcodes are parsed and executed on the server, effectively providing a code execution or injection vector. The vulnerability is a classic example of CWE‑730 (Insecure Design / Execution from untrusted input) and CWE‑74 (Injection).

Affected Systems

Affected products are the Advanced Custom Fields: Extended plugin and its PRO edition for WordPress, specifically in versions 0.9.2.4 through 0.9.2.7 inclusive. No other vendors or product versions are listed as impacted.

Risk and Exploitability

With a CVSS score of 4.8 the vulnerability is considered moderate in severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. From the description it is clear that the attack vector is via an unauthenticated form submission; the user can trigger arbitrary shortcode execution on the server by simply filling and submitting the form.

Generated by OpenCVE AI on October 23, 2026 at 13:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO plugin to a version beyond 0.9.2.7 that disables shortcode processing in form success messages.
  • If an immediate update is not possible, disable shortcode parsing for form confirmation messages by configuring the form settings or removing the feature entirely so that no shortcodes are evaluated server‑side.
  • Audit other WordPress plugins for similar shortcode‑processing behavior in confirmation or success messages and adjust their configurations to prevent server‑side code injection.

Generated by OpenCVE AI on October 23, 2026 at 13:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-730

Fri, 23 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-730

Fri, 23 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-74
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
Title Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-23T10:52:24.979Z

Reserved: 2026-09-21T09:05:53.588Z

Link: CVE-2026-94263

cve-icon Vulnrichment

Updated: 2026-10-23T10:52:21.916Z

cve-icon NVD

Status : Received

Published: 2026-10-23T12:18:19.283

Modified: 2026-10-23T12:18:19.283

Link: CVE-2026-94263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T13:30:07Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')