Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Template Tag Injection via Form Post and Term Actions
- ID
- WPSEC-2026-1278
- Plugin
- Advanced Custom Fields: Extended (acf-extended)
- Affected
- all versions before 0.9.2.8
- Remediation
- Update to 0.9.2.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-917
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Advanced Custom Fields: Extended on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Template Tag Injection via the form Post and Term actions in all versions up to, and including, 0.9.2.7. This is due to template tags being parsed a second time on the post title and slug and on the term name and slug, and to values resolved in the 'raw' context not being escaped. As a result, template tags placed in submitted field values get evaluated. This makes it possible for unauthenticated attackers to run tags such as {get_option:...} and read arbitrary site options and other data through the created or updated posts and terms.
References
- https://wpsec.com/vuln/WPSEC-2026-1278/
- https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/
- https://wordpress.org/plugins/acf-extended/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS