ACF Extended and ACF Extended PRO: Unauthorized shortcode processing in form confirmations
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: 0.9.2.4 to before 0.9.2.8.
- Component
- Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO
- Plugin slug
acf-extended- Affected
- Both editions: 0.9.2.4 to < 0.9.2.8
- Safe version
0.9.2.8- Published
- Oct 23, 2026
This CVE was published Oct 23, 2026 and is one of 15 known issues for this plugin.
Update, patch or deactivate.
Update either affected ACF Extended edition to 0.9.2.8 or a later supported release. Disable shortcode evaluation for untrusted form-confirmation data or use an explicit allowlist of safe operations, applying the restriction even when older stored form configurations lack the setting.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N