WordPress Plugin Vulnerabilities

Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

Description

The plugin does not consistently disable shortcode processing in the confirmation message of its front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
This is an incomplete fix for CVE-2025-15463, which changed only the default applied to newly saved forms.

Proof of Concept

Affects Plugins

Plugin icon
acf-extended
Fixed in 0.9.2.8
Plugin icon
acf-extended-pro
Fixed in 0.9.2.8

References

CVE
CVE-2026-94263

Classification

Type
INJECTION
OWASP top 10
A1: Injection
CVSS
4.8 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
52f1633a-21ae-4273-8f24-5c10c2a92a8b

Timeline

Publicly Published
2026-10-21 (about 2 days ago)
Added
2026-10-21 (about 1 day ago)
Last Updated
2026-10-21 (about 1 day ago)

Other

Published
Title
Published
2026-09-09
Title
Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation
Published
2023-02-16
Title
WoodMart < 7.1.2 - Unauthenticated Arbitrary Shortcode Injection
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
Published
2026-10-15
Title
Forminator Forms < 1.58.2 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Published
2026-10-14
Title
Ocean Extra < 2.6.1 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template