Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
criticalThe Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_arra...
- CVSS:
- 9.8 (Wordfence)
- Affected:
- up to 0.9.2.6
- Fixed in:
- 0.9.2.7
- Disclosed:
- Sep 14, 2026