CVE-2026-120534: Code Injection in ACF Extended

CVE-2026-120534 is a Limited Code Injection vulnerability in the Advanced Custom Fields: Extended PRO plugin for WordPress that allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments via the render_field function. The vulnerability affects all versions up to and including 0.9.2.6.

The vulnerability carries a CVSS score of 9.8 (critical). Two exploitation methods have been identified: Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting on the target form; Method 2 exploits server environments lacking OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding. The official description was published on NVD on 2026-11-03 and records two social mentions in the past 24 hours, including an unverified claim of no available patch.

Defenders should: 1) verify if Advanced Custom Fields: Extended PRO plugin is installed on critical WordPress sites; 2) check version against 0.9.2.6; 3) monitor for security update availability; 4) until a patch is available, disable 'shortcode_preview' if non-essential and verify OpenSSL is enabled on the server; 5) implement additional access controls on exposed forms.