ACF Extended CVE-2026-94263

Exploitation requires the site to publish an ACF Extended / ACF Extended PRO front-end form (versions 0.9.2.4-0.9.2.7) whose STORED form configuration does not carry the setting that disables shortcode processing in the confirmation message; only such forms are affected, which is the attacker-uncontrolled precondition reflected by AC:H. Given that, an unauthenticated visitor needs no credentials and no user interaction beyond a normal form submission to trigger server-side shortcode processing. Limiting factors: no vulnerable/misconfigured front-end form means no exposure, the impact is bounded to shortcodes registered on the target site rather than true arbitrary code execution, and only the listed version range is affected (fixed in 0.9.2.8).

This is a medium-severity issue (CVSS 4.8, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) rather than a top-priority emergency. The signals are internally consistent on reach but modest on impact: AV:N/PR:N/UI:N means any unauthenticated visitor can reach the flaw over the network with no interaction, but AC:H reflects that exploitation depends on a condition the attacker does not control - the targeted front-end form's stored configuration must not carry the setting that disables shortcode processing. It is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the input. The 'RCE' tag overstates the rated impact: the CVSS vector caps impact at C:L/I:L/A:N (limited confidentiality and integrity, no availability), consistent with execution of registered WordPress shortcodes in the site's context rather than unconstrained arbitrary code execution - treat the RCE label as a category hint, not a confirmed impact, and verify what the available shortcodes can actually do on a given site. The vuln.today priority is 'this_month', aligning with a real but non-urgent fix window. A public PoC reference exists (WPScan) but is not verified as working exploit code, so POC availability should not be read as active exploitation.

An unauthenticated visitor finds a public front-end form published by a site running ACF Extended (free or PRO) version 0.9.2.4-0.9.2.7 whose stored configuration lacks the setting that disables shortcode processing in the confirmation message. The visitor submits the form, and the server renders the confirmation message with embedded shortcodes executed server-side in the site's context, limited to whatever registered shortcodes are available. A public PoC reference exists (WPScan); it is not verified as working exploit code.