CVE-2026-94263 in Advanced Custom Fields Extended Plugin
Summary
by MITRE • 10/23/2026
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within versions 0.9.2.4 through 0.9.2.7 of the Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins represents a critical server-side code execution risk stemming from improper input validation and state management in front-end form processing logic. The core issue lies in the inconsistent handling of shortcode parsing within confirmation messages generated after a user submits a form. While the plugin developers intended to disable shortcode processing for security reasons, this safeguard is not uniformly applied across all configuration states or submission scenarios. Specifically, when a form's stored configuration lacks explicit settings regarding shortcode execution, the system fails to enforce the expected restriction, thereby leaving the door open for malicious actors to inject arbitrary shortcodes into the confirmation message payload.
From a technical perspective, this flaw exploits the WordPress template rendering engine which automatically parses and executes registered shortcodes found within post content or dynamic output buffers. When an unauthenticated visitor submits a form that triggers a confirmation message containing user-supplied data, the application inadvertently passes this data through the shortcode parser without adequate sanitization or escaping mechanisms. This allows attackers to craft specific input strings that contain malicious shortcodes designed to execute server-side commands. Because the vulnerability affects front-end forms accessible by any internet user without requiring authentication, it significantly lowers the barrier for exploitation compared to vulnerabilities restricted to administrative interfaces.
The operational impact of this vulnerability is severe, as successful exploitation can lead to remote code execution on the targeted web server. An attacker could leverage this flaw to deploy web shells, exfiltrate sensitive database information, or pivot further into the internal network infrastructure hosting the WordPress instance. The lack of authentication requirements means that automated scanning tools and opportunistic attackers can easily discover and exploit these instances at scale. This aligns with common attack patterns observed in large-scale internet-wide campaigns targeting vulnerable plugins where initial access is gained through simple form submissions rather than complex multi-step exploits.
This vulnerability maps directly to CWE-94, which describes Improper Control of Generation of Code (Code Injection), as the application allows user input to influence the execution of server-side code via shortcodes. Furthermore, it relates to CWE-79, commonly known as Cross-Site Scripting if the context were purely client-side, but in this case, the severity is elevated due to the server-side execution component. In terms of MITRE ATT&CK framework classification, this behavior corresponds to T1059 Command and Scripting Interpreter, specifically through web-based methods such as HTML scripting or command injection via application interfaces. The failure to consistently disable a known dangerous feature constitutes an insecure default configuration that violates principles of least privilege and secure by design.
Mitigation strategies must prioritize immediate patching to the latest stable version where this inconsistency has been resolved. Administrators should verify their plugin versions and update accordingly if they are running any build between 0.9.2.4 and 0.9.2.7. In environments where updating is not immediately feasible, temporary mitigations include disabling shortcodes globally within WordPress by removing the add_shortcode function calls for specific plugins or using a web application firewall to block requests containing suspicious shortcode patterns in form submission payloads. Additionally, implementing strict input validation on all front-end forms and ensuring that confirmation messages are rendered with output escaping functions such as esc_html can prevent the execution of injected code even if similar vulnerabilities exist elsewhere in the plugin suite. Regular security audits focusing on state management inconsistencies in form handling logic are recommended to identify and remediate similar architectural flaws before they can be exploited by malicious actors seeking initial access points within WordPress ecosystems.