Is CVE-2025-15463 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15463 being exploited in the wild.

How severe is CVE-2025-15463?

Medium severity, with a CVSS score of 6.5, published 12 May 2026.

Which products and versions are affected?

ACF Extended Advanced Custom Fields: Extended Up to, and including, 0.9.2.3.

Is there a fix for CVE-2025-15463?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15463 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-15463?

Check whether you run ACF Extended Advanced Custom Fields: Extended at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15463: ACFE Advanced Custom Fields: Extended arbitrary shortcode execution

CVE-2025-15463 · Severity: medium · CVSS 6.5 · Published 2026-05-12

The Advanced Custom Fields: Extended plugin for WordPress, which provides enhanced form and field management tools, contains a security flaw that allows unauthorized users to execute arbitrary shortcodes. This could allow an attacker to access sensitive information or perform unauthorized actions on the website by exploiting how the plugin processes form data. The vulnerability affects all versions of the plugin up to and including 0.9.2.3.

Technologies: ACF Extended Advanced Custom Fields: Extended. Vendors: ACF Extended.

Quick answers

Is CVE-2025-15463 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15463 being exploited in the wild.
How severe is CVE-2025-15463?: Medium severity, with a CVSS score of 6.5, published 12 May 2026.
Which products and versions are affected?: ACF Extended Advanced Custom Fields: Extended Up to, and including, 0.9.2.3.
Is there a fix for CVE-2025-15463?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15463 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-15463?: Check whether you run ACF Extended Advanced Custom Fields: Extended at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Advanced Custom Fields: Extended (ACFE) plugin for WordPress is vulnerable to arbitrary shortcode execution due to a lack of input validation in the form rendering and email action modules. Specifically, the software allows unauthenticated users to trigger actions that pass unvalidated values into the WordPress 'do_shortcode' function. An attacker can exploit this by submitting crafted requests to the front-end form rendering components or email action handlers. This can lead to the execution of any registered shortcode on the site, potentially resulting in information disclosure or further exploitation depending on the available shortcodes. The vulnerability is present in versions up to and including 0.9.2.3.

Affected products

ACFE Advanced Custom Fields: Extended Up to, and including, 0.9.2.3

Timeline

2026-05-12: disclosed: Initial publication of the CVE record.
2026-05-12: advisory: Wordfence published the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.