CVE-2025-13486: WordPress ACF Extended Plugin RCE Flaw

CVE-2025-13486 Overview

The Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress contains a critical Remote Code Execution (RCE) vulnerability affecting versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepare_form() function, which improperly accepts user-supplied input and passes it directly to PHP's call_user_func_array() function. This dangerous code pattern allows unauthenticated attackers to execute arbitrary code on the server, potentially leading to complete site compromise including backdoor injection and creation of malicious administrative accounts.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on vulnerable WordPress installations, enabling complete server compromise, data theft, and persistent backdoor access.

Affected Products

• Advanced Custom Fields: Extended plugin version 0.9.0.5
• Advanced Custom Fields: Extended plugin version 0.9.1.0
• Advanced Custom Fields: Extended plugin version 0.9.1.1

Discovery Timeline

• December 3, 2025 - CVE-2025-13486 published to NVD
• December 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-13486

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code, or Code Injection). The core issue stems from the prepare_form() function within the ACF Extended plugin accepting user-controlled input without proper validation or sanitization. This input is subsequently passed to PHP's call_user_func_array() function, a dangerous pattern that allows attackers to invoke arbitrary PHP functions with attacker-controlled arguments.

The call_user_func_array() function in PHP is designed to call a callback function with parameters provided as an array. When user input can influence either the callback function name or the parameters, attackers can execute virtually any PHP function available in the runtime environment. This can include system command execution functions like system(), exec(), passthru(), or file manipulation functions.

Since the vulnerability requires no authentication, any remote attacker with network access to the WordPress installation can exploit this flaw. The exploitation does not require any user interaction, making it particularly dangerous for internet-facing WordPress sites using the affected plugin versions.

Root Cause

The root cause is insufficient input validation in the prepare_form() function combined with the unsafe use of call_user_func_array(). The function accepts external input that directly influences the callback function or its parameters, creating a code injection pathway. Proper security controls would require strict allowlisting of permitted callbacks and thorough sanitization of all user-supplied data before use in dynamic function calls.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable WordPress endpoint, manipulating the input parameters processed by prepare_form(). By controlling the function name or arguments passed to call_user_func_array(), the attacker can:

1. Execute arbitrary PHP functions on the server
2. Run system commands to establish reverse shells
3. Write malicious files to the web root for persistent access
4. Create new WordPress administrator accounts
5. Modify existing files to inject backdoors
6. Exfiltrate sensitive data including database credentials

The vulnerability mechanism centers on the prepare_form() function accepting user input and passing it to call_user_func_array() without proper validation. This allows attackers to specify arbitrary PHP callbacks with controlled arguments. For technical details on the specific code changes, refer to the WordPress ACF Extended Changeset.

Detection Methods for CVE-2025-13486

Indicators of Compromise

• Unexpected PHP files in WordPress directories, particularly in wp-content/plugins/ or wp-content/uploads/
• Newly created administrator accounts not authorized by site owners
• Unusual outbound network connections from the web server
• Modified core WordPress or plugin files with injected code
• Web server access logs showing suspicious POST requests to ACF Extended endpoints

Detection Strategies

• Monitor web server logs for unusual POST requests targeting ACF Extended plugin endpoints with abnormal parameter patterns
• Implement file integrity monitoring on WordPress installations to detect unauthorized file modifications
• Deploy web application firewalls (WAF) with rules to detect PHP code injection attempts
• Review WordPress user accounts for unauthorized administrator creation
• Scan for known webshell signatures in the WordPress installation directory

Monitoring Recommendations

• Enable verbose logging on WordPress and web server components to capture detailed request data
• Configure alerting for new user account creation, especially with administrator privileges
• Monitor server resource utilization for anomalies indicating cryptomining or other malicious activity
• Implement network-level monitoring for suspicious outbound connections from web servers

How to Mitigate CVE-2025-13486

Immediate Actions Required

• Update Advanced Custom Fields: Extended plugin to the latest patched version immediately
• If immediate patching is not possible, deactivate the ACF Extended plugin until a fix can be applied
• Audit WordPress installations for signs of compromise including unauthorized users and modified files
• Review web server logs for evidence of exploitation attempts
• Consider temporarily restricting access to WordPress admin areas via IP allowlisting

Patch Information

The vulnerability has been addressed by the plugin maintainers. Security updates are tracked in the WordPress ACF Extended Changeset. Site administrators should update to the latest available version through the WordPress plugin update mechanism. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Deactivate the ACF Extended plugin if updating is not immediately possible
• Implement web application firewall (WAF) rules to block malicious requests targeting the vulnerable function
• Restrict access to the WordPress site at the network level using IP-based access controls
• Enable WordPress security plugins that can detect and block code injection attempts

# Disable the vulnerable plugin via WP-CLI until patching
wp plugin deactivate acf-extended

# Verify no unauthorized admin accounts exist
wp user list --role=administrator --fields=ID,user_login,user_email

# Check for recently modified files in the plugin directory
find /path/to/wordpress/wp-content/plugins/ -mtime -7 -type f -name "*.php"