Sensitive Information Exposure in Advanced Custom Fields: Extended Plugin for WordPress

CVE-2026-110305

What is CVE-2026-110305?

The Advanced Custom Fields: Extended plugin for WordPress is susceptible to data leaks due to sensitive information exposure. In all versions up to and including 0.9.2.7, unauthenticated attackers have the potential to exploit this vulnerability by injecting a {get_user} template tag. This tag, when processed, can expose sensitive data such as the WordPress password hashes of users. The successful exploitation is dependent on specific configurations by administrators, particularly if a public [acfe_form] shortcode page is set up with a Term action that includes a save.name field mapping. Proper safeguards and updates are essential to protect against this risk.

References