CVE-2025-13486

CVE-2025-13486 is a critical unauthenticated remote code execution vulnerability (CWE-94) in the Advanced Custom Fields: Extended WordPress plugin, affecting versions 0.9.0.5 through 0.9.1.1. The flaw resides in the prepare_form() function, which accepts user-supplied input and passes it to call_user_func_array(), so a crafted unauthenticated HTTP request can cause arbitrary code to execute on the server. A successful attacker gains code execution, which can be used to inject backdoors or create new administrative user accounts, potentially leading to full site takeover. Any WordPress site running an affected version of the plugin — estimated in the low tens of thousands of installs — is exposed, with the greatest risk on sites where the plugin's form functionality is reachable by anonymous visitors. No public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation have been reported yet, but the 67.6% EPSS score (99th percentile) indicates a high likelihood of exploitation within 30 days.

What to do: Update Advanced Custom Fields: Extended to a version beyond 0.9.1.1 as soon as possible; if patching is delayed, disable the plugin or restrict access to its front-end form endpoints. Audit affected sites for unexpected administrator accounts, unfamiliar files, and modified plugin or core files that could indicate a backdoor. Prioritize this patch given the 9.8 CVSS score and high EPSS probability of near-term exploitation.