PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Dec 15, 2025

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
2.5k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2025-13486
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Advanced Custom Fields: Extendedby hwk-fr
0.9.0.5
Updated Sep 9, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution Scanner | S4E