A critical security vulnerability identified as CVE-2026-120534 has been discovered within the ACF Extended PRO plugin for WordPress. The flaw, which was officially reserved on November 2, 2026, and subsequently published on November 3, 2026, has been linked to reports of active exploitation occurring on the same day as its public disclosure.
The vulnerability is currently tracked by security researchers, with evidence of exploitation first surfacing in public databases on November 3. While the specific technical nature of the exploit remains under ongoing analysis, the timeline indicates a rapid transition from the disclosure of the vulnerability to its utilization in the wild.
The claim of active exploitation is currently supported by a single commercial vulnerability research catalog. Other major tracking entities, including the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog and the European Union Agency for Cybersecurity (ENISA) vulnerability database, have not yet listed this specific vulnerability. Because the reports of exploitation rely on limited source material, the extent and nature of the threat are still being evaluated by the broader cybersecurity community.
The vulnerability affects users of the ACF Extended PRO plugin, a popular tool used to enhance the functionality of Advanced Custom Fields within WordPress environments. Given the nature of such plugins, which often interact with sensitive site data and administrative functions, the potential for unauthorized access or site compromise remains a primary concern for administrators.
Although the vulnerability has been assigned a CVE identifier, official severity scores and detailed weakness classifications are currently pending further review. The current EPSS (Exploit Prediction Scoring System) data places the vulnerability in the 24.2nd percentile, reflecting a moderate level of interest from threat actors relative to the broader landscape of known vulnerabilities.
Users of the ACF Extended PRO plugin are advised to monitor official channels for security patches and updates. As is standard practice for WordPress plugin vulnerabilities, administrators should ensure their installations are running the most recent version of the software to mitigate risks associated with unpatched code.
While the reports of exploitation on the day of disclosure are significant, the lack of corroboration from multiple independent threat intelligence sources suggests that the situation is still developing. Security teams should prioritize the verification of their own plugin versions and review site logs for any signs of anomalous activity that might indicate an attempt to leverage this specific flaw.
As of the current reporting window, no official statement from the plugin developers regarding the specific technical remediation or the validity of the exploitation claims has been widely disseminated. Further updates are expected as more security researchers analyze the underlying code and the scope of the reported exploitation becomes clearer.
