ACF Extended CVE-2026-110305

Exploitation requires a specific, administrator-created configuration: a publicly accessible page containing an [acfe_form] shortcode with a Term action that maps a form field to the term 'name' via a save.name field mapping (a supported, documented configuration). Given that configuration, an unauthenticated remote attacker can inject a {get_user} template tag that the plugin resolves and writes into a publicly readable term name, exposing the WordPress password hash of any user. Limiting factors: the vulnerable acfe_form Term-action/save.name configuration is NOT present by default and must have been deliberately set up and published publicly by an administrator; sites running ACF Extended without such a public form are not exposed. No user interaction or attacker authentication is required against a vulnerable configuration.

This is a genuine but conditionally-gated priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) correctly frames an unauthenticated, network-reachable confidentiality breach - the exposure of WordPress password hashes is high-impact because those hashes enable offline cracking and subsequent account/admin takeover. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with the risk being real yet not indiscriminately exploitable. The key tempering signal is a precondition OUTSIDE the raw CVSS score: exploitation requires that a site administrator has previously configured a public [acfe_form] page with a Term action mapping a field to save.name - a documented but non-default setup. So PR:N is accurate for the attacker (no authentication needed), but the attack surface only exists on sites with that specific configuration, making this closer to opportunistic/targeted than mass-exploitable. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided in the input, so there is no current evidence of widespread active exploitation. Net: prioritize patching on any site running ACF Extended that uses acfe_form Term actions, but this is not a blanket internet-wide emergency for all installs.

On a WordPress site where an administrator has published a public page containing an [acfe_form] shortcode whose Term action maps a submitted field to the term 'name' (save.name), an unauthenticated attacker submits the form with a value containing the {get_user} template tag. The plugin resolves that tag server-side and writes the result - including a target user's password hash - into a publicly readable term name, which the attacker then simply reads back. No public exploit code is identified in the provided data, but the mechanism is described concretely in the Wordfence advisory and the referenced plugin source.