CVE-2025-13486

Exploitation massive de CVE-2025-13486 Advanced Custom Fields : Extended 0.9.0.5 - 0.9.1.1 - Exécution de code à distance non authentifiée dans prepareform ⚠️ Détails de la vulnérabilité Le plugin Advanced Custom Fields: Extended pour WordPress est vulnérable à l'exécution de code à distance dans...

cve-2025-13486-vuln-setup

CVE-2025-13486 Environnement de test vulnérable Configuration Docker unique pour tester la vulnérabilité RCE d'ACF Extended. Démarrage rapide 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 аутентифицированное RCE Proof-of-concept для CVE-2026-65008 : аутентифицированное удалённое выполнение кода в Grav CMS через неограниченный calluserfuncarray в Blueprint::dynamicData. Пользователь с правами admin.pages или api.pages.write может внедрить вредоносный...

CVE-2025-13486-POC

CVE-2025-13486 Preuve de concept Un exploit de preuve de concept PoC pour CVE-2025-13486, une vulnérabilité d'exécution de code à distance dans le plugin WordPress Advanced Custom Fields: Extended ACFE. Aperçu de la vulnérabilité Cette vulnérabilité existe dans les versions d'ACFE 0.9.0.5 à...

CVE-2025-13486

Exploit CVE-2025-13486 Plugin ACF Extended WordPress — Exécution de code à distance et élévation de privilèges Exploit pour la CVE-2025-13486 découverte par Marcin Dudek dudekmar ⚠️ Avertissement Ce dépôt est fourni uniquement à des fins de recherche et de sécurité défensive. L'auteur décline tout...

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

GHSA-C4WF-2XXC-68QM Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...

GHSA-FJ2P-QJ2F-74V5 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...

EUVD-2026-62549

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData...

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...

CVE-2026-64850

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850

In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850: Improper Control of Generation of Code

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498

Affected software: Query Wrangler plugin for WordPress (tested up to version 1.5.57). Vulnerability: Remote Code Execution via the options parameter in the wp_ajax_qw_form_ajax handler. Root cause is a missing capability check and nonce verification, with unsanitized attacker-controlled options b...

EUVD-2026-59852

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...