External risk intelligence

Advanced Custom Fields Extended for WordPress Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13486

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications accessible via the internet. Because the plugin functionality is part of the public web server interface and reachable by unauthenticated users, it is highly probable to be exposed to the internet in standard deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects a popular WordPress plugin, potentially allowing unauthenticated attackers to execute arbitrary code on your servers. This could lead to severe compromises, including the injection of backdoors or the creation of unauthorized administrator accounts.

Code execution risk in WordPress plugin.
Unauthenticated attackers can take control.
Confirm relevance and check plugin exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a WordPress site using the affected plugin. The attacker targets the `prepare_form()` function, which improperly handles user-provided data by passing it to `call_user_func_array()`. Successful exploitation allows an attacker to execute arbitrary code on the server, potentially leading to the installation of backdoors or the creation of new administrator accounts.

No authentication required to attack.
Trigger via the `prepare_form()` function.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on a WordPress server. When the `prepare_form()` function in the Advanced Custom Fields: Extended plugin is used, it may pass user-controlled input to `call_user_func_array()`. This could potentially lead to the injection of malicious code or the creation of new administrative accounts on the affected system.

Server code execution is at risk.
Malicious input could be executed on the server.
System compromise and data breaches are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Advanced Custom Fields: Extended WordPress plugin's remote code execution vulnerability necessitates immediate action from teams managing WordPress deployments. Application owners and infrastructure teams should prioritize identifying all instances of this plugin, assessing their exposure and business criticality, and then planning remediation. This involves coordinating with security and vendor management if the plugin was obtained through third parties. The first practical move is to locate affected systems, confirm reachability and impact, and assign ownership for remediation planning.

WordPress administrators and infrastructure teams.
Verify plugin instances and exposure.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advanced Custom Fields: Extended plugin?

This software is an extension for the Advanced Custom Fields plugin in WordPress. It adds specialized features and tools to the core plugin, which is widely used to manage custom metadata and fields for website content. Developers use it to simplify complex data entry and display tasks within the WordPress dashboard environment.

What does CVE-2025-13486 mean for my security?

This vulnerability is classified as CWE-94, which refers to improper control of generation of code. Essentially, the software fails to sanitize input correctly before processing it. In this specific case, the plugin allows user-provided data to influence function execution, which an attacker can manipulate to run unauthorized commands directly on the server hosting your website.

How can an attacker trigger this vulnerability?

An attacker targets the prepare_form() function within the plugin. They do not need to be logged into your site to do this; they simply send a specially crafted network request to the server that interacts with this specific function. If the plugin is active and receiving these requests, it may pass the malicious input to a system function that executes it. Requests that do not interact with this specific form-preparation logic will not trigger the bug.

Why should I care about this vulnerability?

According to Halo Surface Signal, this vulnerability is considered a high priority because WordPress plugins are frequently used on public-facing websites. Since the attack is possible without authentication, any site running an affected version and accessible via the internet is potentially exposed to remote code execution, which can lead to a full site compromise.

How do I start addressing this issue?

Begin by auditing your WordPress environment to identify if the Advanced Custom Fields: Extended plugin is installed and whether it falls within the affected version range of 0.9.0.5 through 0.9.1.1. Once you locate these instances, determine if they are internet-accessible. Prioritize your response by confirming which sites are reachable and assigning responsibility for checking for official vendor updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.