External risk intelligence

Advanced Custom Fields Extended PRO Code Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-120534

The vulnerability resides in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications accessible via the internet. Since the plugin processes form configurations and handles user-facing functions, it is part of the standard web application attack surface exposed to public traffic.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Advanced Custom Fields: Extended PRO plugin for WordPress has a critical vulnerability that could allow unauthenticated attackers to execute arbitrary functions on a WordPress site. This exposure stems from insufficient validation of form configuration parameters, potentially leading to the compromise of website operations.

Unauthenticated users can execute code on the website.
Critical flaw impacts widely used WordPress plugin functionality.
Confirm relevance and exposure on WordPress sites.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a WordPress site using the Advanced Custom Fields: Extended PRO plugin. The attacker would need to target a form where a specific setting is enabled, or where the server environment lacks OpenSSL. This would allow the attacker to execute arbitrary WordPress functions with their chosen arguments, potentially leading to a full site compromise.

No authentication required.
Specially crafted form configuration.
Arbitrary function calls.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could execute arbitrary WordPress functions when certain conditions are met, potentially impacting the integrity and availability of the website. This could occur if an administrator has enabled the 'shortcode_preview' setting for a form or if the server environment lacks OpenSSL, causing a fallback to unverified base64 decoding.

Website functions and data integrity.
Via insufficient validation of form parameters.
Compromise of website operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in a WordPress plugin, suggesting that platform or application owners are primarily responsible for remediation. The initial step should be to identify all WordPress instances using the affected plugin, confirm their exposure and criticality, and then coordinate with the relevant teams for a risk-based remediation plan.

Application owners should manage remediation.
Verify plugin usage and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advanced Custom Fields: Extended PRO plugin?

It is a WordPress extension that enhances the core Advanced Custom Fields (ACF) plugin, adding advanced form-building capabilities and custom field management. Developers use it to create complex data structures and dynamic user interfaces within WordPress sites. The vulnerability affects how this plugin processes form configuration data before rendering fields for visitors.

What does this CVE mean in terms of weakness class?

This vulnerability is classified as CWE-434, which typically involves improper input validation. In the context of CVE-2026-120534, the plugin fails to sanitize user-supplied form parameters. Because these parameters are passed to internal function-calling mechanisms without sufficient checks, it allows an unauthenticated party to trigger arbitrary code execution by mimicking function calls.

How does an attacker trigger this vulnerability?

An attacker sends crafted requests to target specific WordPress form functions. It does not trigger if the 'shortcode_preview' setting is disabled and the server environment correctly utilizes OpenSSL for secure decryption. The flaw relies on either that specific administrative setting being active or the server falling back to insecure base64 decoding due to missing cryptographic libraries.

Is my site at risk according to Halo Surface Signal?

Yes, if you run this plugin on a WordPress site accessible via the internet. Halo Surface Signal identifies this as a 'Likely' risk because public-facing web applications naturally expose plugin-driven form processing to internet traffic. Since the plugin handles user-facing functions, any instance reachable from the web presents an attack surface for this flaw.

What should I do if I use this WordPress plugin?

Begin by auditing your WordPress environment to confirm where this plugin is installed and active. Determine if your server configuration relies on standard OpenSSL functions and check if the 'shortcode_preview' setting is currently enabled for any forms. Prioritize these findings with your technical team to coordinate updates or temporary configuration changes while waiting for a vendor patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.