Critical Limited Code Injection Vulnerability in Advanced Custom Fields: Extended PRO Plugin
A critical vulnerability, CVE-2026-120534, with a CVSS score of 9.8, was discovered in the Advanced Custom Fields: Extended PRO plugin for WordPress. This vulnerability allows unauthenticated attackers to inject code and call arbitrary WordPress functions. It affects all versions up to and including 0.9.2.6. Immediate patching is recommended to prevent potential exploitation.