SZB-4b06f3b156
EUVD flags sensitive data exposure in Advanced Custom Fields: Extended (CVSS 7.5)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- hwk-fr
- Product
- Advanced Custom Fields: Extended
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114215 for the Advanced Custom Fields: Extended WordPress plugin, versions up to and including 0.9.2.7. The entry says unauthenticated attackers could extract sensitive information.
If you use hwk-fr
Update Advanced Custom Fields: Extended to a version newer than 0.9.2.7
Deactivate the plugin if no fixed version is available
Rotate any secrets or credentials that may be stored in custom field data
What the sources say 1
· Mastodon: “The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process.” Source