cve-2025-13486-vuln-setup

CVE-2025-13486 脆弱性テスト環境 ACF Extended の RCE 脆弱性をテストするためのワンショット Docker セットアップ。 クイックスタート root@kitploit: 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t CVE-2025-13486.yaml -u http://localhost:8888...

CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - 認証なし特権昇格（'acfpostid' パラメータへのバリデーションバイパス経由） この重大なセキュリティ脆弱性（CVSS 9.8）は、人気のWordPressプラグイン Advanced Custom Fields: Extended（ACF Extended）のバージョン0.9.2.5以降のすべてのバージョンに影響します。 バージョン0.9.2.6で修正されましたが、脆弱性は以下のように動作します： 問題の関数：...

CVE-2026-80467

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2025-13486

CVE-2025-13486 Exploit ACF Extended WordPress-Plugin – Remotecodeausführung & Privilegienerweiterung Exploit für CVE-2025-13486, entdeckt von Marcin Dudek dudekmar ⚠️ Haftungsausschluss Dieses Repository dient ausschließlich Forschungs- und Verteidigungszwecken. Der Autor übernimmt keine...

WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...

Exploit for CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 -...

CVE-2025-15463

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This make...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.5 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by daroo in WordPress Plugin ACF Extended versions = 0.9.2.5...

📄 WordPress ACF 0.9.1.1 Remote Code Execution

WordPress ACF plugin version 0.9.1.1 unauthenticated remote code execution proof of concept exploit. ============================================================================================================================================= | Title : WordPress ACF 0.9.1.1 unauthenticated Remote...

Exploit for CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Re...

📄 WordPress ACF 0.9.1.1 Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...

WordPress ACF Extended Unauthenticated RCE via prepare_form()

This module exploits an unauthenticated Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...

CVE-2021-24865

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue...