CVE-2025-13486 is a critical Remote Code Execution (RCE) vulnerability affecting versions 0.9.0.5 through 0.9.1.1 of the Advanced Custom Fields: Extended plugin for WordPress. The flaw allows unauthenticated attackers to execute arbitrary code on the server by exploiting the prepare_form() function, which improperly handles user input passed to call_user_func_array(). With a CVSS score of 9.8 (CRITICAL), this vulnerability has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability, enabling actions like backdoor injection or administrative account creation. Exploitation is confirmed, with a Metasploit module and Nuclei templates publicly available, and it is actively being exploited in the wild as evidenced by media coverage and community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Hwk-Fr | Advanced Custom Fields: Extended | >= 0.9.0.5, <= 0.9.1.1CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.