CVE-2026-120534

Summary

The Advanced Custom Fields: Extended PRO WordPress plugin allows unauthenticated attackers to call arbitrary WordPress functions via insufficient validation in the render_field method, enabling remote code execution or data exfiltration through controlled function calls.

Exploitability

Exploitation requires either enabling the non-default 'shortcode_preview' setting (Method 1) or a server lacking OpenSSL functions (Method 2), making it moderately difficult but still feasible for targeted attacks.

Blast radius

Successful exploitation could lead to full system compromise including data theft, unauthorized code execution, and site defacement due to unauthenticated access to privileged WordPress functions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.9.2.7 or later, as this is the fixed version that addresses the insufficient validation in the render_field function.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.