CVE-2025-13486

Эксплойт CVE-2025-13486 Плагин ACF Extended для WordPress — удаленное выполнение кода и повышение привилегий Эксплойт для CVE-2025-13486, обнаруженный Marcin Dudek dudekmar ⚠️ Отказ от ответственности Этот репозиторий предоставлен только для исследовательских и защитных целей. Автор не несет...

CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - Неаутентифицированное повышение привилегий через обход проверки параметра 'acfpostid' Эта критическая уязвимость безопасности CVSS 9.8 затрагивает все версии популярного плагина WordPress Advanced Custom Fields: Extended ACF Extended...

cve-2025-13486-vuln-setup

CVE-2025-13486 Уязвимая тестовая среда Одноразовая настройка Docker для тестирования уязвимости ACF Extended RCE. Быстрый старт root@kitploit: 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t...

CVE-2026-80467

███████╗███████╗███╗ ██╗██╗███╗ ███╗ █████╗ ███╗ ██╗ ██╔════╝██╔════╝████╗ ██║██║████╗ ████║██╔══██╗████╗ ██║ ███████╗█████╗ ██╔██╗ ██║██║██╔████╔██║███████║██╔██╗ ██║ ╚════██║██╔══╝ ██║╚██╗██║██║██║╚██╔╝██║██╔══██║██║╚██╗██║ ███████║███████╗██║ ╚████║██║██║ ╚═╝ ██║██║ ██║██║ ╚████║...

CVE-2026-80467

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-80467 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...

Exploit for CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 -...

CVE-2025-15463

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This make...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.5 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by daroo in WordPress Plugin ACF Extended versions = 0.9.2.5...

📄 WordPress ACF 0.9.1.1 Remote Code Execution

WordPress ACF plugin version 0.9.1.1 unauthenticated remote code execution proof of concept exploit. ============================================================================================================================================= | Title : WordPress ACF 0.9.1.1 unauthenticated Remote...

Exploit for CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Re...

📄 WordPress ACF 0.9.1.1 Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...

WordPress ACF Extended Unauthenticated RCE via prepare_form()

This module exploits an unauthenticated Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...

CVE-2021-24865

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue...