/claim #14212

PR Information

• Added CVE-2025-13486 - WordPress ACF Extended < 0.9.1.2 Unauthenticated RCE
• References:
  • https://github.com/lasthero-887/CVE-2025-13486---Poc
  • https://nvd.nist.gov/vuln/detail/CVE-2025-13486
  • https://patchstack.com/database/wordpress/plugin/acf-extended/vulnerability/wordpress-advanced-custom-fields-extended-plugin-0-9-0-5-0-9-1-1-unauthenticated-remote-code-execution-vulnerability

Template validation

• Validated with a host running a vulnerable version and/or configuration (True Positive)
• Validated with a host running a patched version and/or configuration (avoid False Positive)

Additional Details

Attack Flow:

1. Checks for ACF Extended plugin presence
2. Sends malicious POST to admin-ajax.php with action=acfe_prepare_form
3. Exploits unsafe call_user_func_array() in prepare_form() function
4. Confirms RCE via DNS callback (interactsh)

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server