CVE-2025-13486

What it actually does

This is an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended WordPress plugin, affecting versions 0.9.0.5 through 0.9.1.1. The vulnerable prepare_form() function accepts attacker-controlled input and passes it into call_user_func_array(), allowing an attacker to invoke unintended PHP functions or code paths. Because exploitation requires network access only and no authentication or user interaction, successful exploitation can lead to arbitrary code execution in the context of the web server process, modification of WordPress files, creation of administrator accounts, credential theft, data tampering, or full takeover of the affected WordPress site.

Why it matters to the business

A successful attack can result in complete compromise of an affected WordPress site, including defacement, malware or web shell deployment, theft of customer or business data, unauthorized administrator creation, SEO spam, phishing content, and service disruption. The vulnerability has a critical CVSS score, high EPSS likelihood, and weaponized exploit maturity, meaning exposed sites should be treated as high-priority even though the issue is not currently listed in CISA KEV and is not marked as ransomware-associated.

How an attack unfolds

An attacker first identifies a WordPress site running a vulnerable version of the Advanced Custom Fields: Extended plugin. They then send a crafted unauthenticated HTTP request to the vulnerable plugin functionality that reaches prepare_form(). Because attacker-supplied input is passed into call_user_func_array(), the attacker can cause the application to execute unintended PHP functions or otherwise reach attacker-controlled execution paths. After obtaining code execution, the attacker commonly attempts persistence by uploading a PHP web shell, injecting malicious code into theme or plugin files, creating a new WordPress administrator account, or modifying wp-config.php and other application files. Follow-on activity may include credential theft, database access, redirect injection, spam content creation, lateral movement from the web server, or use of the compromised site as infrastructure for malware, phishing, or bot activity.

How to fix it

Immediately upgrade Advanced Custom Fields: Extended to a vendor-confirmed patched version if available. If no fixed version is available or the fixed version cannot be confirmed, disable and remove the plugin until a patched release can be deployed. Specifically ensure versions 0.9.0.5 through 0.9.1.1 are not present on any internet-facing WordPress installation. After remediation, rotate WordPress administrator passwords, review administrator accounts, rotate any secrets stored in wp-config.php, and inspect the filesystem for unauthorized PHP files or modified plugin/theme files. Restrict access to WordPress administrative functions, keep WordPress core, themes, and all plugins fully updated, and place the site behind a WAF or reverse proxy rule that blocks suspicious requests to plugin endpoints while patching is underway.

How to confirm the fix worked

Confirm exposure by inventorying WordPress installations and checking whether the Advanced Custom Fields: Extended plugin is installed and whether its version is between 0.9.0.5 and 0.9.1.1. Validate remediation by confirming the plugin is upgraded to a patched release or fully removed/disabled and that vulnerable plugin files are no longer reachable over HTTP. Review plugin metadata, WordPress admin plugin listings, filesystem paths under wp-content/plugins/, and software composition or vulnerability scan results. Run an authenticated vulnerability scan where possible, then perform a file-integrity comparison against known-good WordPress core, plugin, and theme files. Because this is an RCE with weaponized exploitation, validation should also include compromise assessment, not only version checking.

Typical attack path

1. Scan the internet for WordPress sites exposing the Advanced Custom Fields: Extended plugin.
2. Fingerprint the plugin version or infer exposure from plugin files, responses, or known WordPress paths.
3. Send a crafted unauthenticated request that reaches the vulnerable prepare_form() logic.
4. Abuse attacker-controlled input passed into call_user_func_array() to execute arbitrary server-side code.
5. Deploy persistence such as a PHP web shell, modified plugin/theme file, cron task, or unauthorized WordPress administrator account.
6. Use the compromised site to steal data, alter content, redirect visitors, send spam, host malware, or pivot further.

How to detect it

Check for prior exploitation using web server access logs, WAF logs, PHP error logs, PHP-FPM logs, WordPress audit logs, EDR telemetry, and filesystem integrity data. Look for unauthenticated requests to Advanced Custom Fields: Extended plugin paths followed by PHP errors, unusual process execution by the web server user, new or modified PHP files, or creation of new WordPress administrator accounts. Investigate recently changed files under wp-content/plugins/, wp-content/themes/, wp-content/uploads/, and the WordPress root directory, especially PHP files with obfuscation, eval/base64/gzinflate/assert/system/shell_exec usage, or unexpected POST handlers. Review WordPress user records and audit trails for administrator accounts created after suspicious requests. Inspect wp-config.php, .htaccess, theme functions.php files, mu-plugins, and scheduled tasks for injected code. Network telemetry should be reviewed for unexpected outbound connections from the web server shortly after suspicious HTTP requests, especially to unknown IPs, paste sites, file-sharing services, or command-and-control infrastructure.

• /wp-content/plugins/acf-extended/
• Advanced Custom Fields: Extended
• prepare_form
• call_user_func_array
• wp-content/plugins/acf-extended
• wp-content/uploads/*.php
• wp-content/uploads/*/*.php
• wp-content/themes/*/functions.php
• wp-content/mu-plugins/
• wp-config.php
• /.htaccess
• eval(
• base64_decode(
• gzinflate(
• str_rot13(
• assert(
• shell_exec(
• system(
• passthru(
• proc_open(
• popen(
• phpinfo(
• FilesMan
• WSO
• c99shell
• r57shell

What your security team should do

• Treat this as an urgent internet-facing RCE issue due to unauthenticated exploitation, critical severity, high EPSS probability, and weaponized exploit maturity.
• Inventory all WordPress sites and identify any installation of Advanced Custom Fields: Extended versions 0.9.0.5 through 0.9.1.1.
• Upgrade to a vendor-confirmed patched version immediately; if unavailable, disable and remove the plugin until a fix is confirmed.
• Hunt for post-exploitation activity, including new administrator users, PHP web shells, recently modified plugin/theme files, suspicious wp-config.php changes, and anomalous outbound connections from the web server.
• Rotate WordPress administrator credentials and any secrets or database credentials accessible to the web application if exploitation is suspected or cannot be ruled out.
• Review Apache, Nginx, PHP-FPM, WordPress audit, WAF, EDR, and file-integrity logs for unauthenticated requests to plugin paths and subsequent file creation or account changes.
• Deploy temporary WAF controls to block suspicious requests targeting Advanced Custom Fields: Extended plugin functionality while patching is completed.
• Increase monitoring for recurring reinfection, because attackers may leave backdoors that survive plugin upgrades.