CVE-2026-120534 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-120534 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-120534 is a critical WordPress plugin flaw in Advanced Custom Fields: Extended PRO (ACF Extended PRO), affecting all versions up to and including 0.9.2.6. The bug lives in the render_field path and can let an unauthenticated attacker trigger arbitrary WordPress functions with attacker-controlled arguments under specific conditions. While there is no known exploitation in the wild and it is not in CISA KEV, the severity is high enough that solo developers and small teams should treat this as an urgent patch-and-verify issue.

Two paths are described: one requires an administrator to have enabled the non-default shortcode_preview setting for the target form; the other may be reachable when the server lacks OpenSSL functions and ACF Pro falls back to unverified base64 decoding. In practical terms: if you run this plugin, assume exposure until you confirm your version and configuration are safe.

Immediate Action

  • Upgrade immediately to the first fixed release from the vendor. If the fixed version is not yet confirmed, remove or disable ACF Extended PRO until you can verify a patched build. Vendor advisory / release notes
  • Disable any form or field configuration using shortcode_preview unless you have a documented business need and a patched version.
  • Check your PHP environment for missing OpenSSL support; if OpenSSL is absent, treat the deployment as higher risk and prioritize patching or temporary plugin removal.
  • Rollback only if needed: if the update breaks production, roll back the site content/theme first, not the plugin security fix. Prefer a maintenance window over reverting to a vulnerable version.
  • Isolate the site if you cannot patch today: restrict admin access, enable WAF rules, and monitor for unexpected function calls or form rendering anomalies.

Affected Versions

  • advanced-custom-fields-extended-pro@<=0.9.2.6 vulnerable
  • advanced-custom-fields-extended-pro@>=TODO_FIXED_VERSION safe
  • If you cannot confirm the fixed version, assume all installed copies up to 0.9.2.6 are vulnerable

Resolution Guide

WordPress / plugin update is the primary fix. For small teams, the fastest path is to update the plugin, then verify the installed version in the WordPress admin or on disk.

# If installed as a Composer-managed WordPress plugin
composer show | grep -i "acf.*extended"
composer update vendor/package-name --with-all-dependencies

# If you manage the plugin manually, replace the plugin directory with the patched release
# Example path:
# wp-content/plugins/acf-extended-pro/

JavaScript / package managers are usually not applicable to a WordPress plugin, but if your build pipeline vendors the plugin or a wrapper package, update it directly:

# npm
npm install package-name@TODO_FIXED_VERSION

# yarn
yarn add package-name@TODO_FIXED_VERSION

# pnpm
pnpm add package-name@TODO_FIXED_VERSION

Python / Java / system packages are also typically not the delivery mechanism here, but use these patterns if your deployment wraps the plugin in automation or container tooling:

# pip / pipx
pip install package-name==TODO_FIXED_VERSION
pipx upgrade package-name

# Maven
# Update pom.xml dependency version to TODO_FIXED_VERSION

# Gradle
# implementation("group:artifact:TODO_FIXED_VERSION")

# apt / yum
sudo apt update
sudo apt install --only-upgrade TODO_PACKAGE_NAME
sudo yum update TODO_PACKAGE_NAME

Docker: rebuild images with the patched plugin baked in, then redeploy.

# Rebuild and redeploy your image
docker build -t your-site:patched .
docker run --rm your-site:patched

# If you use a prebuilt image tag, move to the patched tag
# your-registry/your-site:TODO_FIXED_TAG

Config hardening:

# Disable shortcode preview if present in plugin settings
shortcode_preview = false

# If you can gate plugin behavior via environment/config
ACF_EXTENDED_PRO_SHORTCODE_PREVIEW=0

# Temporary containment: disable the plugin entirely
wp plugin deactivate acf-extended-pro

Minimal code-hardening example if you maintain a fork or must hotpatch before upgrading:

// Pseudocode: validate callable and arguments before dispatch
if (!is_string($callback) || !is_callable($callback)) {
    return;
}
$args = is_array($args) ? array_map('sanitize_text_field', $args) : [];
call_user_func_array($callback, $args);

Detection & Verification

Check the installed version in WordPress admin, or on disk:

# Search plugin header/version
grep -Rni "Version:" wp-content/plugins/acf-extended-pro/
grep -Rni "0.9.2.6" wp-content/plugins/acf-extended-pro/

Check whether the risky setting is enabled:

# Search for shortcode_preview in plugin settings, exports, or config
grep -Rni "shortcode_preview" wp-content/

Check for OpenSSL availability in PHP:

php -r 'echo extension_loaded("openssl") ? "openssl:yes\n" : "openssl:no\n";'
php -m | grep -i openssl

Verify the fix after updating:

# Confirm the plugin version no longer matches the vulnerable release
grep -Rni "Version:" wp-content/plugins/acf-extended-pro/

# If you use WP-CLI
wp plugin list | grep -i "acf"
wp plugin get acf-extended-pro --field=version

Dependency / inventory checks:

# Composer inventory
composer show | grep -i "acf\|extended"

# File integrity spot-check
find wp-content/plugins/acf-extended-pro -type f | wc -l

Risk and Impact

This flaw can allow an unauthenticated attacker to make WordPress call functions with controlled inputs, which may lead to data exposure, site defacement, or broader compromise depending on what callable paths are reachable. For a solo developer or small team, the blast radius can include the entire WordPress instance, connected databases, and any secrets stored in configuration files or environment variables. Even without confirmed active exploitation, the combination of critical severity and unauthenticated reach makes this a high-priority patch.

Keep reading