Scan my site freeScan free

Fix guides / Security notices

Security notice

Use ACF Extended PRO on WordPress? A flaw rated 9.8 can let attackers run code on some setups. Update to 0.9.2.8.

Last updated: Tuesday, November 3, 2026, 11:36 AM ETStatus: Fix released in August. No confirmed attacks. Update to 0.9.2.8.

ACF Extended PRO is a paid add-on for WordPress sites that use Advanced Custom Fields, and it adds forms and extra field types. A CVE record published on November 3, 2026 by Wordfence, CVE-2026-120534, rates a flaw in it 9.8 out of 10, and Patchstack rates it 10. In versions up to and including 0.9.2.6, people with no login can make the site call WordPress functions of their choosing, which Wordfence's title and Patchstack call remote code execution, meaning a stranger running their own commands on your server. The CVE says this works only in two cases: a non-default "shortcode_preview" setting is switched on for a form, or the server's PHP lacks its OpenSSL functions. The fix, 0.9.2.7, came out on August 27, 2026, so this flaw has had a fix for over two months, and 0.9.2.8 is the newest. We found no confirmed report of attacks, and CISA does not list it as exploited. If your site runs ACF Extended PRO, update it to 0.9.2.8 today, and then check your site for PHP files and administrator accounts you did not add.

What happened

Who should worry

This is about WordPress websites that use the paid ACF Extended PRO plugin, usually because a developer or agency added it to build forms or custom fields. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

If your site does not use ACF Extended, this notice does not apply to you.

What to do now

Do these today.

  1. Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Advanced Custom Fields: Extended PRO" and for the free "Advanced Custom Fields: Extended." Note the version numbers. 0.9.2.7 or higher has the fix for this flaw, and 0.9.2.8 is the newest.
  2. Update. Update ACF Extended PRO to 0.9.2.8 after taking a backup, and update the free ACF Extended plugin to 0.9.2.8 if you have it. PRO is a paid plugin, so updates usually come through the maker's account or license rather than WordPress.org. If you do not see an update, ask your developer or check your ACF Extended account. (ACF Extended changelog)
  3. If you cannot update today, ask your developer to check two things: whether the "shortcode_preview" setting is switched on for any form, and whether your host's PHP has its OpenSSL functions. If the setting is on, ask whether it can be switched off for now. That is our reading of the CVE record, not the plugin maker's advice, we have not tested it, and it may change how your forms behave. It does not replace the update.
  4. Check for a break-in. We found no confirmed attacks, so there is nothing specific to look for. As a general check, especially if you were on 0.9.2.6 or earlier with a form using the setting above, ask your developer or host to look for PHP files you did not add, in wp-content/uploads and in the plugin folders, for administrator accounts you do not recognize, and for plugins you did not install, and to check server logs for unusual requests to your form pages. If you find anything, treat the site as compromised: restore from a known-good backup, then change the WordPress admin and database passwords and the WordPress salts. This is general advice, not from the sources above.
  5. Check your site afterwards. Open and submit each form that uses ACF Extended and confirm it still works.

What to send your developer, agency or host

ACF Extended PRO 0.9.2.6 and earlier has a critical flaw, CVE-2026-120534 (CVSS 9.8 from Wordfence, 10 from Patchstack, CVE published November 3, 2026): unauthenticated limited code injection that can lead to remote code execution, but only if the non-default shortcode_preview setting is on for a form, or the server's PHP lacks its OpenSSL functions. The first fixed version is 0.9.2.7 (August 27, 2026) and the newest is 0.9.2.8 (October 19, 2026). CISA does not list it as exploited and we found no confirmed report of attacks. WPScan also lists other flaws in the free and PRO plugins before 0.9.2.8. Please tell us whether our site runs ACF Extended PRO or the free ACF Extended and which versions. If either is older than 0.9.2.8, please back up and update both today, check whether shortcode_preview is on for any form and whether PHP has its OpenSSL functions, check wp-content/uploads and the plugin folders for PHP files nobody added, and look for new administrator accounts. If anything looks wrong, please treat the site as compromised, restore a known-good backup and change the admin and database passwords and the WordPress salts, and tell us what you find. Sources: the Wordfence advisory, the CVE record, Patchstack, the ACF Extended changelog.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a critical flaw has a CVE number, a fix has been out since August and we found no confirmed report of attacks.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Which version do I need?

0.9.2.7 fixes this flaw, per Wordfence and Patchstack. Take 0.9.2.8, which is the newest and which also covers the flaws WPScan published on October 23. (Wordfence advisory, Patchstack, ACF Extended changelog)

Is it being exploited?

We found no confirmed report that it is, and CISA does not list it. Patchstack expects flaws like this to be attacked. If you have not updated, do not wait. (Patchstack, CISA KEV)

Does this affect the free ACF Extended plugin?

Not this CVE, which names only the PRO plugin. The free plugin before 0.9.2.8 is affected by other flaws, so update it too. (CVE record, WordPress.org)

Where can I follow official updates?

The ACF Extended changelog and the Wordfence advisory. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan cannot see which WordPress plugins your site runs or which version they are on. No account.

Or sign up free and we check it every day and email you when something changes.