Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Dec 15, 2025

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
0
Times Used
continuous scan runs
10
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Advanced Custom Fields: Extendedby hwk-fr
0.9.0.5
Updated Nov 10, 2026View on NVD →

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Browse All Tools