ACF Extended Pro EUVD-2026-115668

Exploitation is unauthenticated (PR:N) but requires ONE of two non-default preconditions. Method 1: an administrator must have enabled the non-default 'shortcode_preview' setting on the specific target form. Method 2: the server environment must lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding of attacker-supplied data. Limiting factors: default installations (shortcode_preview disabled AND OpenSSL present) are not exploitable, which substantially narrows the realistically affected population below what the 9.8/AV:N rating suggests; only ACF Extended PRO versions up to and including 0.9.2.6 are affected.

The signals pull in two directions and must be reconciled. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) and the vuln.today 'act_now' Decision label both frame this as trivially exploitable unauthenticated critical RCE. However, the description itself reveals that exploitation is gated behind one of two non-default preconditions - Method 1 needs an administrator to have enabled the non-default 'shortcode_preview' setting on the target form, and Method 2 needs the server to lack OpenSSL functions so ACF Pro's acf_decrypt falls back to unverified base64 decoding. That contradicts the AC:L rating: because success depends on a target-side configuration the attacker does not control, real-world attack complexity is higher than 9.8 implies, and default, OpenSSL-equipped installations with shortcode_preview off are not exploitable. No EPSS score, no CISA KEV listing, and no exploit/PoC reference are present in the supplied data, so there is no evidence of active exploitation or public weaponization - the urgency rests on the Wordfence report and the act_now label, not on observed in-the-wild activity. Net: treat as a high-priority patch because the unauthenticated-to-full-compromise impact is severe where conditions are met, but recognize the exploitable population is a conditional subset rather than every install. Authentication requirement is confirmed unauthenticated by PR:N in the provided vector.

A remote unauthenticated attacker locates a WordPress site running ACF Extended PRO (≤0.9.2.6) that either has the non-default 'shortcode_preview' setting enabled on a form (Method 1) or runs on a server without OpenSSL functions (Method 2), then submits crafted form configuration parameters. Those parameters are merged into field settings and passed to call_user_func_array in render_field, letting the attacker invoke arbitrary WordPress functions with attacker-controlled arguments and compromise the site. No public exploit identified at time of analysis; the network attack vector is offset by the required non-default precondition.