Vulnerabilities / Advanced Custom Fields: Extended
Advanced Custom Fields: Extended vulnerabilities
Advisories WPSec published for Advanced Custom Fields: Extended. Other sources may list more. Its attack surface: Advanced Custom Fields: Extended on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-21 | WPSEC-2026-1281 | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Account Takeover via Update User Form Action | High 8.1 | 0.9.2.8 |
| 2026-10-21 | WPSEC-2026-1280 | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary Attachment Deletion via Form Email Action | Medium 4.8 | 0.9.2.8 |
| 2026-10-21 | WPSEC-2026-1279 | Advanced Custom Fields: Extended <= 0.9.2.7 - Authenticated (Contributor+) Sensitive Information Exposure via acfe_form Shortcode Template Tags | Medium 6.5 | 0.9.2.8 |
| 2026-10-21 | WPSEC-2026-1278 | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Template Tag Injection via Form Post and Term Actions | Medium 5.9 | 0.9.2.8 |
License: CC BY 4.0