CVE-2026-120534

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the renderfield function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing ...

CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the renderfield function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing ...

EUVD-2026-115668

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the renderfield function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing ...

CVE-2026-120534

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in versions up to and including 0.9.2.6 . The flaw exists in the render_field function due to insufficient validation of form configuration parameters before they are merged into field settings a...