{"id":"CVE-2025-13486","aliases":["EUVD-2025-200730","GHSA-8q8p-fv92-864w"],"status":"published","title":"Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form","description":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.68598,"percentile":0.99346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2025-12-03T06:47:46Z","modified":"2026-10-18T17:10:00Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/wp_acf_extended_rce","title":"WordPress ACF Extended Unauthenticated RCE via prepare_form()","type":"exploit","platform":"Linux,PHP,Unix,Windows","date":"2025-12-02","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_acf_extended_rce"},{"source":"nuclei","id":"CVE-2025-13486","title":"Advanced Custom Fields Extended \u003c 0.9.2 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13486.yaml"},{"source":"pocgithub","id":"0xanis/CVE-2025-13486-POC","title":"0xanis/CVE-2025-13486-POC","date":"2025-12-04","url":"https://github.com/0xanis/CVE-2025-13486-POC"},{"source":"pocgithub","id":"0xgh057r3c0n/CVE-2025-13486","title":"0xgh057r3c0n/CVE-2025-13486","date":"2025-12-06","url":"https://github.com/0xgh057r3c0n/CVE-2025-13486"},{"source":"pocgithub","id":"0xnemian/CVE-2025-13486.-CVE-2025-13486","title":"0xnemian/CVE-2025-13486.-CVE-2025-13486","date":"2025-12-04","url":"https://github.com/0xnemian/CVE-2025-13486.-CVE-2025-13486"},{"source":"pocgithub","id":"KrE80r/cve-2025-13486-vuln-setup","title":"KrE80r/cve-2025-13486-vuln-setup","date":"2025-12-04","url":"https://github.com/KrE80r/cve-2025-13486-vuln-setup"},{"source":"pocgithub","id":"MataKucing-OFC/CVE-2025-13486","title":"MataKucing-OFC/CVE-2025-13486","date":"2025-12-05","url":"https://github.com/MataKucing-OFC/CVE-2025-13486"},{"source":"pocgithub","id":"whattheslime/CVE-2025-13486","title":"whattheslime/CVE-2025-13486","date":"2025-12-19","url":"https://github.com/whattheslime/CVE-2025-13486"}],"products":[{"vendor":"hwk-fr","product":"advanced custom fields: extended"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c508cb73-53e6-4ebe-b3d0-285908b722c9?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3400134/acf-extended"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13486"},{"url":"https://github.com/advisories/GHSA-8q8p-fv92-864w"}],"sources":{"cve":[{"id":"CVE-2025-13486","title":"Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form","description":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.","status":"published","published":"2025-12-03T06:47:46.73Z","modified":"2025-12-03T14:32:58.739Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:43.437394Z"}],"euvd":[{"id":"EUVD-2025-200730","description":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.","status":"published","published":"2025-12-03T06:47:46Z","modified":"2025-12-03T14:32:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:10.716009Z"}],"ghsa":[{"id":"GHSA-8q8p-fv92-864w","title":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution...","description":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.","status":"published","published":"2025-12-03T09:31:12Z","modified":"2025-12-03T09:31:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:05:01.323335Z"}],"nvd":[{"id":"CVE-2025-13486","description":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.","status":"published","published":"2025-12-03T07:16:02.84Z","modified":"2026-10-18T17:10:00.11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:11:47.746175Z"}]}}