Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

CVE List

01 Why this matters

CVE-2026-94263 has no exploitation data yet. Impact if it lands: CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Check if you run it Follow the feed

02 Facts

CVSS: CVSS 4.8 (v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: No EPSS yet
CISA KEV: Not on the CISA KEV list
Dates: published Oct 23, 2026
modified Oct 23, 2026
Severity: medium

03 Affected packages

No package ranges are published for this id.

04 Advisory text

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

https://wpscan.com/vulnerability/52f1633a-21ae-4273-8f24-5c10c2a92a8b/

06 Ask your agent

With the geoa-cve MCP server connected

explain_impact CVE-2026-94263

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2026-94263. Danger: Low, CVSS 4.8.