CRITICAL CWE-94
CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Hwk-fr·Advanced Custom Fields: Extended
9.8/ 10
CVSS 3.1
Critical severity
69%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.4% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Dec 3, 2025
- Updated
- Dec 3, 2025
- First covered
- Jul 11, 2026
- Latest story
- 4 months ago
Summary
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
CWE-94Improper Control of Generation of Code ('Code Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
- Hwk-fr Advanced Custom Fields: Extended0.9.0.5 to 0.9.1.1