CVE-2026-120534

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended PRO versions prior to 0.9.2.7

Description Insufficient validation of form configuration parameters before they are merged into field settings and passed to the call user func array function within the render field() method allows unauthenticated attackers to execute arbitrary WordPress functions with controlled arguments. This can lead to full website takeover. Exploitation can occur via two methods: one requiring the administrator to enable the non-default shortcode preview setting for the target form, and another occurring if the server environment lacks OpenSSL functions, which forces the acf decrypt function to use unverified base64 decoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.