CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
- Published
- Dec 3, 2025
- Updated
- Dec 3, 2025
- Assigning CNA
- Wordfence
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.3%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
Sources
modules/exploits/multi/http/wp_acf_extended_rce.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,PHP,Unix,Windows($.exploit_multi/http/wp_acf_extended_rce.platform)
- verification: check_declared($.exploit_multi/http/wp_acf_extended_rce.check)
http/cves/2025/CVE-2025-13486.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
POC for CVE-2025-13486
- CVE-2025-13486Exploit
Advanced Custom Fields Extended (ACFE) WordPress Plugin Exploit RCE - Admin Creation
Docker test environment for CVE-2025-13486 (ACF Extended RCE). For security research only.
- CVE-2025-13486Exploit
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function.
- CVE-2025-13486Exploit
CVE-2025-13486 - Remote Code Execution & Privilege Escalation exploit
- CVE-2025-13486.-CVE-2025-13486Research
Vulnerable setup for CVE-2025-13486 - Advanced Custom Fields: Extended - Remote Code Execution
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.