CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2025-13486

CVE-2025-13486 漏洞利用 ACF Extended WordPress 插件 — 远程代码执行与权限提升 针对 CVE-2025-13486 的漏洞利用，由 Marcin Dudek dudekmar 发现 ⚠️ 免责声明 本仓库仅用于研究和防御性安全目的 。 作者对本信息的滥用不承担任何责任。 📌 概述 WordPress 的 Advanced Custom Fields: Extended ACFE 插件在 0.9.0.5 至 0.9.1.1 版本中存在远程代码执行 RCE 漏洞。 该漏洞存在于 prepareform...

CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - Escalada de Privilegios No Autenticada mediante Bypass de Validación al Parámetro 'acfpostid' Esta vulnerabilidad de seguridad crítica CVSS 9.8 afecta a todas las versiones del popular plugin de WordPress Advanced Custom Fields: Extended...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - 任意文件上传漏洞利用 CVE-2024-56264 概述 此仓库包含针对 CVE-2024-56264 的利用代码，该漏洞是 WordPress ACF City Selector 插件（版本 = 1.14.0）中发现的任意文件上传 漏洞。此漏洞允许攻击者将恶意 PHP 文件（Web Shell）上传到存在漏洞的 WordPress 实例，并在服务器上执行任意命令。 CVE 详情 CVE ID: CVE-2024-56264 发布日期： 2025年1月2日 受影响插件： ACF City...

cve-2025-13486-vuln-setup

CVE-2025-13486 漏洞测试环境 用于测试 ACF Extended RCE 漏洞的一键式 Docker 环境。 快速开始 root@kitploit: 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t CVE-2025-13486.yaml -u http://localhost:8888 手动插件设置...

CVE-2025-12030

CVE-2025-12030: Insecure Direct Object Reference in ACF to REST API WordPress Plugin Keywords: CVE-2025-12030, ACF to REST API vulnerability, IDOR, WordPress security, authenticated exploit, WordPress plugin vulnerability, CWE-639, ACF field modification, authorization bypass, WordPress CVE 2025,...

CVE-2026-80467

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73522 COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtptocan function increments its write...

EUVD-2026-51716

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

CVE-2026-15262

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

CVE-2026-12428

The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getallvalues function in the /wp-json/acf-field-blocks/v1/values REST endpoint in versions up to, and including, 1.6.2. The permissioncallback only verifies the...