{
 "id": "WPSEC-2026-1278",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1278/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1278/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1278/index.md",
 "title": "Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Template Tag Injection via Form Post and Term Actions",
 "description": "The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Template Tag Injection via the form Post and Term actions in all versions up to, and including, 0.9.2.7. This is due to template tags being parsed a second time on the post title and slug and on the term name and slug, and to values resolved in the 'raw' context not being escaped. As a result, template tags placed in submitted field values get evaluated. This makes it possible for unauthenticated attackers to run tags such as {get_option:...} and read arbitrary site options and other data through the created or updated posts and terms.",
 "plugin": {
  "slug": "acf-extended",
  "name": "Advanced Custom Fields: Extended",
  "full_name": "Advanced Custom Fields: Extended",
  "wordpress_org": "https://wordpress.org/plugins/acf-extended/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acf-extended/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acf-extended"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-917"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.9.2.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.9.2.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.9.2.8",
 "remediation": "Update to 0.9.2.8 or later.",
 "fix_released": "2026-10-19T13:23:29+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:09.721780+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1278/",
  "https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/",
  "https://wordpress.org/plugins/acf-extended/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acf-extended",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}