Skip to contentHwk-fr Advanced Custom Fields: Extended vulnerabilities
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag InjectionCVE-2026-1103057.5 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX EndpointsCVE-2026-28395.3 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File FieldCVE-2026-107524.8 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success MessageCVE-2026-942634.8 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionCVE-2026-942688.1 High
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionCVE-2026-942679.0 Critical
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode AttributesCVE-2026-942646.8 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update ActionCVE-2026-942628.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert ActionCVE-2026-80467Public exploit8.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionCVE-2026-125268.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' ParameterCVE-2026-8809Public exploit9.8 Critical
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2025-154636.5 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form ActionCVE-2025-145339.8 Critical
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formCVE-2025-13486Public exploitEPSS 68.6%9.8 Critical
- hwk-fr advanced custom fields: extended, acfextended advanced custom fields extended +1 moreAdvanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2023-52926.4 Medium
- hwk-fr advanced custom fields: extended, acf-extended advanced custom fields\ +1 moreAdvanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionCVE-2021-248657.2 High