Advanced Custom Fields Extended PRO Plugin Code Injection Vulnerability

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to and including 0.9.2.6. The flaw exists in the render_field function, where insufficient validation of form configuration parameters allows them to be merged into field settings and passed to call_user_func_array.

This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.

Two methods are described:

• Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form.
• Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.