Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

The impact of this RCE vulnerability is severe. An attacker exploiting this flaw can gain complete control over the WordPress server hosting the affected website. This includes the ability to install malware, steal sensitive data (user credentials, database information, customer data), modify website content, and potentially pivot to other systems on the network. The prepareform() function's improper handling of user input, specifically passing it to calluserfuncarray(), creates the opportunity for arbitrary code execution. This is a high-risk scenario, similar to other RCE vulnerabilities in WordPress plugins that have led to widespread compromise.

Websites utilizing the Advanced Custom Fields: Extended plugin in versions 0.9.0.5 through 0.9.1.1 are at significant risk. Shared hosting environments are particularly vulnerable, as a compromise of one website can potentially impact others on the same server. WordPress installations with default or weak security configurations are also at higher risk.

• wordpress / composer / npm:

grep -r 'call_user_func_array' /var/www/html/wp-content/plugins/advanced-custom-fields-extended/

• wordpress / composer / npm:

wp plugin list | grep 'advanced-custom-fields-extended'

• wordpress / composer / npm:

wp plugin update advanced-custom-fields-extended

• generic web: Check WordPress plugin directory for mentions of the vulnerability and potential exploit attempts. • generic web: Review WordPress access and error logs for suspicious activity related to the plugin.

1. 2025-12-02Disclosure

   disclosure

Actieve installaties

100KBekend

Plugin-beoordeling

4.8

Vereist WordPress

4.9+

Compatibel tot

7.0

Vereist PHP

5.6+

1. Gereserveerd2025-11-20
2. Gepubliceerd2025-12-02
3. Gewijzigd2025-12-03
4. EPSS bijgewerkt2026-03-23

The primary mitigation is to immediately upgrade the Advanced Custom Fields: Extended plugin to version 0.9.2 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. As a secondary measure, implement a Web Application Firewall (WAF) rule to block requests targeting the prepare_form() function with suspicious input. Thoroughly review WordPress user roles and permissions to limit the potential impact of a successful attack. After upgrading, confirm the vulnerability is resolved by attempting to trigger the vulnerable function with malicious input and verifying that it is properly sanitized.