CVE-2026-120534 is a critical (CVSS 9.8) limited code injection flaw in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6.
What Is It
The flaw is in the plugin's render_field function. Form configuration parameters are not validated properly before they are merged into field settings and passed to call_user_func_array in the render_field method. Because of this, unauthenticated attackers can call arbitrary WordPress functions with arguments they control. In effect, user-controlled input decides which function the plugin runs and what it receives.
NVD lists two exploitation paths:
- Method 1: An administrator has turned on the
shortcode_previewsetting for the target form. This setting is off by default. - Method 2: The server has no OpenSSL functions available. ACF Pro's
acf_decryptthen falls back to base64 decoding without verification.
Wordfence reported the issue. The NVD record's status is "Deferred".
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- It can be exploited over the network with low attack complexity.
- It needs no privileges and no user interaction.
- The impact on confidentiality, integrity and availability is high.
Being able to call any WordPress function with controlled arguments as an unauthenticated visitor gives an attacker a strong foothold on an affected site. Both methods depend on a precondition, either a setting that is off by default or a server missing OpenSSL. Exposure is therefore narrower than the 9.8 score alone suggests.
Exploitation status: No CISA KEV entry was supplied for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| ACF Extended | Advanced Custom Fields: Extended PRO | All versions ≤ 0.9.2.6 |
No CPE data was in the NVD record. Two kinds of site are most at risk:
- Sites where
shortcode_previewis turned on for any form - Sites on hosts where PHP's OpenSSL functions are unavailable
Patch Status
The NVD record does not name a fixed version. It only says that versions up to and including 0.9.2.6 are affected. The vendor changelog is listed as a reference, and administrators should check it for a release later than 0.9.2.6 that fixes the issue.
There is no CISA KEV required action or due date, since no KEV entry exists. Until a fix is confirmed and applied, administrators should:
- Confirm that
shortcode_previewis turned off on all forms - Make sure OpenSSL functions are available in the server's PHP environment
These steps follow from the two exploitation conditions described above.