Critical · published December 3, 2025
CVSS calls it critical at 9.8. It sits in the 99.3th percentile for exploit probability.
🚨 A single function in the Advanced Custom Fields: Extended plugin can lead to full Remote Code Execution! An unauthenticated attacker can run any code they want, like a kid entering a candy store without a chaperone. 🔥 Think of it like a restaurant where a customer can change the menu without the chef’s approval. The prepare_form() function here lets attackers submit their own ingredients—code—into the mix, potentially ruining the meal (or your site)! This vulnerability is absolutely devastating! An attacker could execute malicious code, allowing them to inject backdoors or create new administrative accounts. Imagine the chaos of someone controlling your entire website without you even knowing it!
Think of it like a restaurant where a customer can change the menu without the chef’s approval. The prepare_form() function here lets attackers submit their own ingredients—code—into the mix, potentially ruining the meal (or your site)! The vulnerability stems from the prepare_form() function in versions 0.9.0.5 through 0.9.1.1, which improperly processes user input via call_user_func_array(), enabling remote code execution by unauthenticated users.
This vulnerability is absolutely devastating! An attacker could execute malicious code, allowing them to inject backdoors or create new administrative accounts. Imagine the chaos of someone controlling your entire website without you even knowing it! Immediately update the Advanced Custom Fields: Extended plugin to version 0.9.1.2 or later to patch this vulnerability. Additionally, review your user permissions and consider implementing stricter input validation to further secure your site. You've got this! Follow these steps, and you'll be back in control of your site in no time! 🛡️