{
 "id": "WPSEC-2026-1279",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1279/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1279/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1279/index.md",
 "title": "Advanced Custom Fields: Extended <= 0.9.2.7 - Authenticated (Contributor+) Sensitive Information Exposure via acfe_form Shortcode Template Tags",
 "description": "The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'acfe_form' shortcode in all versions up to, and including, 0.9.2.7. This is due to the shortcode accepting almost any form setting as an attribute, including the success message, and then processing template tags such as {get_option:...} in those values. This makes it possible for authenticated attackers with contributor-level access and above to read arbitrary site options and other data that template tags can return.",
 "plugin": {
  "slug": "acf-extended",
  "name": "Advanced Custom Fields: Extended",
  "full_name": "Advanced Custom Fields: Extended",
  "wordpress_org": "https://wordpress.org/plugins/acf-extended/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acf-extended/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acf-extended"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.9.2.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.9.2.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.9.2.8",
 "remediation": "Update to 0.9.2.8 or later.",
 "fix_released": "2026-10-19T13:23:29+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:09.721780+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1279/",
  "https://plugins.svn.wordpress.org/acf-extended/tags/0.9.2.8/",
  "https://wordpress.org/plugins/acf-extended/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acf-extended",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}