Arbitrary Shortcode Execution Vulnerability in Advanced Custom Fields: Extended Plugin

CVE-2025-15463

What is CVE-2025-15463?

The Advanced Custom Fields: Extended plugin for WordPress is susceptible to arbitrary shortcode execution in all versions up to and including 0.9.2.3. This vulnerability arises from improper validation of user input when executing shortcodes. Unauthenticated attackers can exploit this flaw to execute arbitrary shortcodes, potentially leading to unauthorized actions within the application. It is crucial for site owners using this plugin to review their installations and apply necessary updates to mitigate any security risks.

References