Lucene search
+L

19 matches found

Kitploit
Kitploit
added 2026/09/03 7:52 a.m.2 views

cve-2025-13486-vuln-setup

CVE-2025-13486 漏洞测试环境 用于测试 ACF Extended RCE 漏洞的一键式 Docker 环境。 快速开始 root@kitploit: 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t CVE-2025-13486.yaml -u http://localhost:8888 手动插件设置...

9.8CVSS7.4AI score0.67623EPSS
SaveExploits11
Kitploit
Kitploit
added 2026/09/02 3:44 p.m.4 views

CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - 未经验证的权限提升 via Validation Bypass to 'acfpostid' Parameter 此严重安全漏洞(CVSS 9.8)影响流行的 WordPress 插件 Advanced Custom Fields: Extended(ACF Extended)自版本 0.9.2.5 起的所有版本。 尽管已在版本 0.9.2.6 中修复,但该漏洞的工作原理如下: 问题函数: 漏洞的根源在于 aftervalidatesavepost 函数对名为...

9.8CVSS5.9AI score0.008EPSS
SaveExploits1
NVD
NVD
added 2026/09/02 6:17 a.m.6 views

CVE-2026-80467

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

8.1CVSS0.00132EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 6:00 a.m.30 views

CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

0.00132EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 6:00 a.m.6 views

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

8.1CVSS5.8AI score0.00145EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/28 4:18 p.m.7 views

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

4.3CVSS0.00152EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/28 2:33 p.m.9 views

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

4.3CVSS5.9AI score0.00152EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/28 2:33 p.m.23 views

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

4.3CVSS5.9AI score0.00152EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/28 2:33 p.m.32 views

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

4.3CVSS0.00152EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/28 9:21 a.m.3 views

CVE-2025-13486

CVE-2025-13486 Exploit ACF Extended WordPress-Plugin – Remotecodeausführung & Privilegienerweiterung Exploit für CVE-2025-13486, entdeckt von Marcin Dudek dudekmar ⚠️ Haftungsausschluss Dieses Repository dient ausschließlich Forschungs- und Verteidigungszwecken. Der Autor übernimmt keine...

9.8CVSS7.4AI score0.67623EPSS
SaveExploits11
Patchstack
Patchstack
added 2026/08/27 11:43 a.m.5 views

WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...

4.3CVSS5.3AI score0.00152EPSS
SaveExploits0Affected Software1
GithubExploit
GithubExploit
added 2026/06/12 8:09 a.m.128 views

Exploit for CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 -...

9.8CVSS5.6AI score0.008EPSS
SaveExploits1
RedhatCVE
RedhatCVE
added 2026/06/05 7:42 p.m.18 views

CVE-2025-15463

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This make...

6.5CVSS6AI score0.00381EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/06/01 8:07 a.m.22 views

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.5 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by daroo in WordPress Plugin ACF Extended versions = 0.9.2.5...

9.8CVSS5.8AI score0.008EPSS
SaveExploits1References1Affected Software1
Packet Storm
Packet Storm
added 2026/03/04 12:00 a.m.208 views

📄 WordPress ACF 0.9.1.1 Remote Code Execution

WordPress ACF plugin version 0.9.1.1 unauthenticated remote code execution proof of concept exploit. ============================================================================================================================================= | Title : WordPress ACF 0.9.1.1 unauthenticated Remote...

9.8CVSS6.5AI score0.67623EPSS
SaveExploits11
GithubExploit
GithubExploit
added 2025/12/19 10:49 a.m.12 views

Exploit for CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Re...

9.8CVSS9.7AI score0.67623EPSS
SaveExploits11
Packet Storm
Packet Storm
added 2025/12/19 12:00 a.m.249 views

📄 WordPress ACF 0.9.1.1 Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...

9.8CVSS8.6AI score0.67623EPSS
SaveExploits11
Metasploit
Metasploit
added 2025/12/02 12:00 a.m.604 views

WordPress ACF Extended Unauthenticated RCE via prepare_form()

This module exploits an unauthenticated Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...

9.8CVSS9.8AI score0.67623EPSS
SaveExploits11
ATTACKERKB
ATTACKERKB
added 2022/01/24 8:15 a.m.9 views

CVE-2021-24865

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue...

7.2CVSS7.1AI score0.01502EPSS
SaveExploits2References3
Rows per page
Query Builder