cve-2025-13486-vuln-setup

CVE-2025-13486 Vulnerable Test Environment One-shot Docker setup for testing ACF Extended RCE vulnerability. Quick Start root@kitploit: 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t...

CVE-2026-80467

███████╗███████╗███╗ ██╗██╗███╗ ███╗ █████╗ ███╗ ██╗ ██╔════╝██╔════╝████╗ ██║██║████╗ ████║██╔══██╗████╗ ██║ ███████╗█████╗ ██╔██╗ ██║██║██╔████╔██║███████║██╔██╗ ██║ ╚════██║██╔══╝ ██║╚██╗██║██║██║╚██╔╝██║██╔══██║██║╚██╗██║ ███████║███████╗██║ ╚████║██║██║ ╚═╝ ██║██║ ██║██║ ╚████║...

CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Remote Code Execution & Privilege Escalation Exploit for the CVE-2025-13486 discovered by Marcin Dudek dudekmar ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author assumes no responsibility...

CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - Escalada de Privilegios No Autenticada mediante Bypass de Validación al Parámetro 'acfpostid' Esta vulnerabilidad de seguridad crítica CVSS 9.8 afecta a todas las versiones del popular plugin de WordPress Advanced Custom Fields: Extended...

WordPress Advanced Custom Fields: Extended plugin < 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ACF Extended versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.2-0.9.2.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.2-0.9.2.6...

CVE-2026-80467

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

PT-2026-84626

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81284: Missing Authorization

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

PT-2026-83145

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...

Exploit for CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 -...

CVE-2025-15463

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This make...