Acf Extended
Monthly
Unauthenticated attackers can invoke arbitrary WordPress functions with attacker-controlled arguments through the render_field method in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6. Exploitation is not unconditional: it requires either the non-default 'shortcode_preview' setting to be enabled on the targeted form, or a server environment lacking OpenSSL functions so that ACF Pro's acf_decrypt falls back to unverified base64 decoding - default installations with shortcode_preview disabled and OpenSSL present are not exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-reported severity is critical and the priority decision is act_now, so exposed sites running the PRO plugin should be triaged promptly.
Stored cross-site scripting in the ACF Extended WordPress plugin, affecting versions through 0.9.2.7, allows script content persisted in plugin-managed fields or forms to execute when a victim later views the page where that input is rendered. CVSS 7.1 reflects network reachability, low complexity, scope change, and required user interaction, with limited confidentiality, integrity, and availability impact; the privilege needed to store the payload is not confirmed in the available sources. No public exploit was identified at time of analysis.
Unauthenticated remote users may be able to read protected data from WordPress sites running ACF Extended through 0.9.2.7 because the plugin does not enforce an authorization check in some access-controlled functionality (CWE-862). The CVSS 3.1 score is 7.5 with confidentiality-only impact and no integrity or availability effect; the exact endpoint and configuration state required are not described in the available sources. Patchstack reported the issue, no CISA KEV entry is present, no public exploit identified at time of analysis, and vuln.today places it in the this_week priority tier.
Arbitrary file deletion in ACF Extended through 0.9.2.7 allows a low-privileged authenticated user to use path traversal sequences to remove files outside the intended directory on a WordPress host, affecting integrity and availability without direct confidentiality loss. The flaw is a CWE-22 path traversal reported by Patchstack and rated CVSS 6.5; the vuln.today decision framework places it in the 'this_month' remediation queue rather than emergency action. No public exploit code or active exploitation is identified at time of analysis, and the specific vulnerable endpoint and trigger are not described in the supplied sources.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.
Unauthenticated attackers can invoke arbitrary WordPress functions with attacker-controlled arguments through the render_field method in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6. Exploitation is not unconditional: it requires either the non-default 'shortcode_preview' setting to be enabled on the targeted form, or a server environment lacking OpenSSL functions so that ACF Pro's acf_decrypt falls back to unverified base64 decoding - default installations with shortcode_preview disabled and OpenSSL present are not exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-reported severity is critical and the priority decision is act_now, so exposed sites running the PRO plugin should be triaged promptly.
Stored cross-site scripting in the ACF Extended WordPress plugin, affecting versions through 0.9.2.7, allows script content persisted in plugin-managed fields or forms to execute when a victim later views the page where that input is rendered. CVSS 7.1 reflects network reachability, low complexity, scope change, and required user interaction, with limited confidentiality, integrity, and availability impact; the privilege needed to store the payload is not confirmed in the available sources. No public exploit was identified at time of analysis.
Unauthenticated remote users may be able to read protected data from WordPress sites running ACF Extended through 0.9.2.7 because the plugin does not enforce an authorization check in some access-controlled functionality (CWE-862). The CVSS 3.1 score is 7.5 with confidentiality-only impact and no integrity or availability effect; the exact endpoint and configuration state required are not described in the available sources. Patchstack reported the issue, no CISA KEV entry is present, no public exploit identified at time of analysis, and vuln.today places it in the this_week priority tier.
Arbitrary file deletion in ACF Extended through 0.9.2.7 allows a low-privileged authenticated user to use path traversal sequences to remove files outside the intended directory on a WordPress host, affecting integrity and availability without direct confidentiality loss. The flaw is a CWE-22 path traversal reported by Patchstack and rated CVSS 6.5; the vuln.today decision framework places it in the 'this_month' remediation queue rather than emergency action. No public exploit code or active exploitation is identified at time of analysis, and the specific vulnerable endpoint and trigger are not described in the supplied sources.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.