CVE-2025-13486

CVE-2025-13486 익스플로잇 ACF Extended WordPress 플러그인 — 원격 코드 실행 및 권한 상승 Marcin Dudek dudekmar가 발견한 CVE-2025-13486 익스플로잇 ⚠️ 면책 조항 이 저장소는 연구 및 방어적 보안 목적으로만 제공됩니다. 작성자는 이 정보의 오용에 대해 책임을 지지 않습니다. 📌 개요 WordPress용 Advanced Custom Fields: Extended ACFE 플러그인은 0.9.0.5부터 0.9.1.1까지의 버전 에서 원격 코드 실행RCE 취약점에 노출됩니다...

CVE-2025-13486

CVE-2025-13486 대량 익스플로잇 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - prepareform에서 인증 없는 원격 코드 실행 ⚠️ 취약점 세부 정보 WordPress용 Advanced Custom Fields: Extended 플러그인은 0.9.0.5부터 0.9.1.1 버전까지 prepareform 함수를 통해 원격 코드 실행에 취약합니다. 이는 함수가 사용자 입력을 받아 calluserfuncarray로 전달하기 때문입니다. 이를 통해 인증되지 않은 공격자가...

cve-2025-13486-vuln-setup

CVE-2025-13486 취약점 테스트 환경 ACF Extended RCE 취약점을 테스트하기 위한 원샷 Docker 구성입니다. 빠른 시작 1. 플러그인 다운로드 최초 1회 실행 ./download-plugins.sh 2. 환경 시작 docker-compose up -d --build 3. 설정 완료까지 약 30초 대기 후 테스트 nuclei -t CVE-2025-13486.yaml -u http://localhost:8888 수동 플러그인 설정 다운로드 스크립트가 실패할 경우, 다음 파일을 plugins/에 수동으로...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 인증된 RCE CVE-2026-65008 에 대한 개념 증명PoC: Blueprint::dynamicData의 제한 없는 calluserfuncarray를 통한 Grav CMS 인증된 원격 코드 실행. admin.pages또는 api.pages.write 권한이 있는 사용자는 악성 form frontmatter를 심을 수 있습니다. 이후 어떤 방문자인증되지 않은 사용자 포함가 페이지를 로드하면 페이로드가 웹 서버 사용자 권한으로 실행됩니다. 승인된 테스트 전용. 자신이...

CVE-2025-13486-POC

CVE-2025-13486 개념 증명 CVE-2025-13486에 대한 개념 증명PoC 익스플로잇으로, Advanced Custom Fields: Extended ACFE WordPress 플러그인의 원격 코드 실행 취약점입니다. 취약점 개요 이 취약점은 ACFE 버전 0.9.0.5부터 0.9.1.1까지 존재하며, 인증되지 않은 공격자가 acfe/form/renderformajax AJAX 액션을 통해 임의의 PHP 함수를 실행할 수 있게 합니다. 플러그인은 사용자 입력을 적절히 검증하지 않고 calluserfuncarray를...

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

GHSA-C4WF-2XXC-68QM Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

EUVD-2026-62549

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData...

GHSA-FJ2P-QJ2F-74V5 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...

CVE-2026-64850

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850

In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850: Improper Control of Generation of Code

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498

Affected software: Query Wrangler plugin for WordPress (tested up to version 1.5.57). Vulnerability: Remote Code Execution via the options parameter in the wp_ajax_qw_form_ajax handler. Root cause is a missing capability check and nonce verification, with unsanitized attacker-controlled options b...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...