# Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Template Tag Injection via Form Post and Term Actions

- **ID:** WPSEC-2026-1278
- **Plugin:** Advanced Custom Fields: Extended (`acf-extended`), https://wordpress.org/plugins/acf-extended/
- **Affected versions:** all versions before 0.9.2.8
- **Fixed in:** 0.9.2.8 (Update to 0.9.2.8 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-917
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acf-extended
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1278/

## Description

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Template Tag Injection via the form Post and Term actions in all versions up to, and including, 0.9.2.7. This is due to template tags being parsed a second time on the post title and slug and on the term name and slug, and to values resolved in the 'raw' context not being escaped. As a result, template tags placed in submitted field values get evaluated. This makes it possible for unauthenticated attackers to run tags such as {get_option:...} and read arbitrary site options and other data through the created or updated posts and terms.

## References

- https://wpsec.com/vuln/WPSEC-2026-1278/
- https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/
- https://wordpress.org/plugins/acf-extended/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1278/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.