Acf Extended Vulnerabilities

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter — with n...

CVSS:

9.8

Affected:

up to 0.9.2.5

Fixed in:

0.9.2.6

Disclosed:

May 28, 2026

CVE-2026-8809 on NVD →

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unau...

CVSS:

6.5

Affected:

up to 0.9.2.3

Fixed in:

0.9.2.4

Disclosed:

May 12, 2026

CVE-2025-15463 on NVD →

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it possible for unauthenticated attackers to supply the 'administr...

CVSS:

9.8

Affected:

up to 0.9.2.1

Fixed in:

0.9.2.2

Disclosed:

Jan 19, 2026

CVE-2025-14533 on NVD →

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attacker...

CVSS:

9.8

Affected:

0.9.0.5 – 0.9.1.1

Fixed in:

0.9.2

Disclosed:

Dec 2, 2025

CVE-2025-13486 on NVD →

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with c...

CVSS:

6.4

Affected:

up to 0.8.9.3

Fixed in:

0.8.9.4

Disclosed:

Sep 29, 2023

CVE-2023-5292 on NVD →

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue

CVSS:

7.2

Affected:

up to 0.8.8.6

Fixed in:

0.8.8.7

Disclosed:

Dec 24, 2021

CVE-2021-24865 on NVD →