PT-2025-31977 · WordPress · Advanced Custom Fields Pro+1

Published 2025-08-05 · Updated 2025-08-05 · CVE-2012-10025

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields (ACF) versions 3.5.1 and earlier

Description The Advanced Custom Fields (ACF) plugin for Wordpress is susceptible to a remote file inclusion (RFI) issue in the core/actions/export.php file. When the allow url include PHP configuration directive is enabled, an unauthenticated attacker can exploit the acf abspath POST parameter to include and execute arbitrary remote PHP code. This can lead to remote code execution within the web server's context, potentially resulting in a full system compromise.

Recommendations Versions prior to 3.5.1: Disable the allow url include directive in the PHP configuration.

Fix

RCE

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2012-10025

Affected Products

Acf

Advanced Custom Fields Pro

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2012-10025 · Security Note
• http://web.archive.org/web/20121223025326/http://secunia.com:80/advisories/51037 · Note
• https://wordpress.org/plugins/advanced-custom-fields · Note
• https://vulncheck.com/advisories/wordpress-plugin-advanced-custom-fields-remote-file-inclusion · Note
• https://t.me/CVEtracker/29231 · Telegram Post
• https://exploit-db.com/exploits/23856 · Note
• https://tenable.com/plugins/nessus/63326 · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-custom-fields/advanced-custom-fields-351-remote-code-execution-via-remote-file-inclusion · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb · Note
• https://wpscan.com/vulnerability/d132d93b-509c-490d-8001-87147ed28c5e · Note