CVE-2026-13152

CVE-2026-13152: Unauthenticated Privilege Escalation in Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Advisory Overview CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

CVE-2026-10752

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

EUVD-2026-110756

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-10752 Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-10752

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 0.9.2.6 . The flaw stems from a failure to properly verify user permissions, allowing unauthenticated attackers to permanently delete arbitrary WordPress media librar...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by normaandersonfrank in WordPress Plugin ACF Extended versions = 0.9.2.6...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2025-13486

🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress Plugin Exploit 📋 Overview Proof-of-concept exploit for CVE-2025-13486 , a critical vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin that allows Remote Code Execution leading to Privilege Escalation. 🎯...

PT-2026-126383

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-116198

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

CVE-2026-94263

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

EUVD-2026-108668

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

CVE-2026-94263 Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

CVE-2026-94263

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins (versions 0.9.2.4 through 0.9.2.7 ) are vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the inconsistent failure to disable shortcode processing within the confirmation ...

WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover vulnerability

Unauthenticated Non-Administrator Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover vulnerability

Unauthenticated Non-Administrator Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ACF Extended versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended PRO plugin < 0.9.2.8 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.8...

WordPress Advanced Custom Fields: Extended plugin < 0.9.2.8 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.8...