28 matches found
CVE-2025-13486
CVE-2025-13486 explotación Plugin ACF Extended para WordPress — Ejecución Remota de Código y Escalada de Privilegios Explotación de la CVE-2025-13486 descubierta por Marcin Dudek dudekmar ⚠️ Aviso legal Este repositorio se proporciona únicamente con fines de investigación y seguridad defensiva. El...
CVE-2026-8809
CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to 'acfpostid' Parameter This critical security vulnerability CVSS 9.8 affects all versions of the popular WordPress plugin Advanced Custom Fields: Extended ACF Extended from...
cve-2025-13486-vuln-setup
CVE-2025-13486 Vulnerable Test Environment One-shot Docker setup for testing ACF Extended RCE vulnerability. Quick Start 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t CVE-2025-13486.yaml -u...
CVE-2026-80467
███████╗███████╗███╗ ██╗██╗███╗ ███╗ █████╗ ███╗ ██╗ ██╔════╝██╔════╝████╗ ██║██║████╗ ████║██╔══██╗████╗ ██║ ███████╗█████╗ ██╔██╗ ██║██║██╔████╔██║███████║██╔██╗ ██║ ╚════██║██╔══╝ ██║╚██╗██║██║██║╚██╔╝██║██╔══██║██║╚██╗██║ ███████║███████╗██║ ╚████║██║██║ ╚═╝ ██║██║ ██║██║ ╚████║...
WordPress Advanced Custom Fields: Extended PRO plugin <= 0.9.2.6 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Advanced Custom Fields: Extended PRO versions = 0.9.2.6...
WordPress Advanced Custom Fields: Extended plugin < 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ACF Extended versions 0.9.2.7...
WordPress Advanced Custom Fields: Extended plugin 0.9.2.2-0.9.2.6 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.2-0.9.2.6...
CVE-2026-80467
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
EUVD-2026-69871
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
PT-2026-84626
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
CVE-2026-81284
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
EUVD-2026-67727
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
CVE-2026-81284
CVE-2026-81284 affects the WordPress plugin ACF Extended in versions
PT-2026-83145
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
CVE-2026-81284: Missing Authorization
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...
