A premium WordPress add-on that agencies install to extend Advanced Custom Fields can be driven into running arbitrary code by an unauthenticated visitor. The flaw is now tracked publicly, and the obvious patched version is still not safe.

What happened

The render_field method in Advanced Custom Fields: Extended PRO merged form configuration parameters into field settings without validating them, then handed the result to call_user_func_array. On versions up to and including 0.9.2.6 an unauthenticated request can therefore invoke arbitrary WordPress functions with arguments the attacker supplies. Wordfence rates it 9.8, and the CVE record carries the same CVSS 3.1 vector.

Two conditions reach the same primitive. Either an administrator enabled the non-default shortcode_preview setting on a form, or the server's PHP build lacks OpenSSL functions, which makes acf_decrypt fall back to unverified base64 decoding. Neither condition needs a logged-in attacker.

Who is affected

Any WordPress site running ACF Extended PRO at 0.9.2.6 or older, which is the entire release history before the quiet fix on 27 August 2026.

• Sites on 0.9.2.6 or earlier: exposed to CVE-2026-120534 outright.
• Sites that already moved to 0.9.2.7: closed for this flaw, but still open to CVE-2026-94267, a 9.8 unauthenticated RCE through the front-end post update action, and to CVE-2026-94262, an unauthenticated non-admin account takeover.
• Agencies and resellers that build client sites on ACF and then hand over maintenance: the plugin version on those sites is usually whatever was installed at launch.

What to do now

Update ACF Extended PRO to 0.9.2.8 or later, not 0.9.2.7. 0.9.2.8 shipped on 19 October 2026 and closes the injection plus the two follow-on flaws that 0.9.2.7 introduced when its authorization fix was incomplete.

• List every site running acf-extended-pro and record the installed version before you touch anything.
• Upgrade to 0.9.2.8 or later, then confirm the version actually changed on disk, not just in the dashboard.
• On sites that ran 0.9.2.6 or older and are internet facing, treat the installation as possibly compromised: review administrator accounts, compare wp_users against what wp-admin shows, and check for unexpected files in wp-content and mu-plugins.
• If a site cannot be updated this week, remove or deactivate the plugin until it can.

What this means for South African businesses

This is a paid add-on, not a free plugin from the repository, so it clusters on sites that an agency built and then left on a maintenance contract with no real review. That makes discovery the hard part: nobody is scanning their own portfolio for it. If you host client WordPress sites, the exposure is not theoretical - it is a list you can produce in an hour and a half-finished migration you will find while producing it.

Source: Wordfence Intelligence advisory for CVE-2026-120534.

Also on the blog

• Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap
• Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.