ACF Extended PRO through 0.9.2.6 – Actively Exploited Unauthenticated RCE (CVE-2026-120534)

Patch immediately: Advanced Custom Fields: Extended PRO versions through 0.9.2.6 are affected by an unauthenticated remote code execution vulnerability tracked as CVE-2026-120534. Patchstack lists the issue among recently exploited WordPress vulnerabilities. Version 0.9.2.7 contains the initial fix; administrators should move to the current 0.9.2.8 release because it includes additional form and callback hardening.

Exploit path and prerequisites

The vulnerable Dynamic Render field flow did not sufficiently validate front-end form configuration before merging attacker-controlled values into field settings and invoking a PHP callback. That can allow a remote visitor to call an allowed WordPress or PHP function with controlled arguments.

Wordfence documents two important prerequisites. One path requires the non-default shortcode_preview option to have been enabled for an affected form. A second path can become reachable when the server lacks OpenSSL functions and the underlying ACF decryption routine falls back to an unverified base64 path. These conditions narrow exposure, but they are not a substitute for updating.

Active exploitation status

Patchstack marks this vulnerability as known to be exploited and included it in its recently exploited WordPress list on November 3, 2026. This is Patchstack exploitation telemetry; it should not be confused with a CISA Known Exploited Vulnerabilities listing.

Immediate remediation

1. Update ACF Extended PRO to 0.9.2.8 or the newest vendor release available to your licence.
2. Review every front-end ACF Extended form, especially forms using Dynamic Render fields or shortcode preview.
3. Confirm PHP OpenSSL support is present, while treating this only as defense in depth.
4. Rotate WordPress salts, administrator passwords, API credentials and hosting credentials if suspicious requests or unauthorized changes are found.
5. Run a complete file and database integrity review before returning a compromised site to service.

wp plugin list --search=acf-extended --fields=name,status,version,update,update_version
wp plugin update acf-extended-pro
wp user list --role=administrator --fields=ID,user_login,user_registered
wp core verify-checksums
wp plugin verify-checksums --all

Temporary mitigation only: If an update cannot be installed immediately, deactivate ACF Extended PRO or disable the affected public forms and any shortcode preview functionality until the patched release is deployed. Do not rely on a WAF rule or OpenSSL availability as the sole fix.

Indicators and verification

• Unexpected unauthenticated requests to pages containing ACF Extended front-end forms or Dynamic Render fields.
• Callback or function names appearing in form parameters, request logs or WAF events.
• New administrator accounts, changed site options, unfamiliar scheduled tasks, modified PHP files or new files under uploads.
• Unexpected child processes or outbound connections from PHP or the web server account.

Verify the installed PRO package is 0.9.2.8 or later, retest affected forms after updating, and review access, WAF and application logs from at least November 3 onward. On sites where vulnerable conditions existed earlier, extend the review to the plugin’s original disclosure date.

Sources

• Patchstack vulnerability record and exploitation status
• Wordfence Intelligence technical record
• ACF Extended release page and changelog