Summary
What it is: An unauthenticated code execution vulnerability. Who it affects: Advanced Custom Fields: Extended plugin. Is it patched: Yes, in version 0.9.2.8. Is it being exploited: No.
Affected and patched versions
Advanced Custom Fields: Extended (plugin acf-extended): affected before 0.9.2.8; fixed in 0.9.2.8
Advanced Custom Fields: Extended PRO (plugin acf-extended-pro): affected before 0.9.2.8; fixed in 0.9.2.8
Is my site vulnerable?
To determine if your site uses a vulnerable version of Advanced Custom Fields: Extended, access your WordPress administration dashboard. Navigate to the "Plugins" section. Locate "Advanced Custom Fields: Extended" or "Advanced Custom Fields: Extended PRO" in the list of installed plugins. The version number is displayed next to the plugin name. Compare this version number against the patched version listed in the "Affected and patched versions" section of this advisory. If your installed version is older than the patched version, your site is exposed to this vulnerability.
What an attacker actually does
This vulnerability allows unauthenticated attackers to execute code on the server. The flaw stems from the Advanced Custom Fields: Extended plugin's front-end form actions, which do not perform any capability checks when updating a post. This absence of checks means that any visitor, without needing to log in or possess specific permissions, can interact with these forms in a way that bypasses intended security controls.
This oversight enables unauthenticated visitors to overwrite arbitrary posts on the WordPress site. This includes posts that the site uses to store its own field definitions. By manipulating these field definitions, an attacker can introduce malicious code into the site's configuration. When the site subsequently processes these altered definitions, the malicious code can be executed on the server.
Exploitation of this vulnerability requires a specific configuration on the target site. The site must publish a form where its post-update action maps both the target post and its content to values submitted by the visitor. If such a form is present and configured in this manner, an attacker can craft a request to overwrite a critical post, inject their code, and achieve arbitrary code execution on the server.
How to detect a compromise
Detecting a compromise related to this vulnerability involves looking for signs of unauthorized post modifications and unexpected code execution on the server. Since the attack allows overwriting arbitrary posts and executing code, indicators can appear in various parts of your WordPress installation and server environment.
One primary indicator is the presence of unexpected changes to posts. This includes alterations to post content, titles, or custom fields that were not made by authorized users. Pay particular attention to posts that define custom fields or store critical site configuration data, as these are likely targets for an attacker seeking to inject malicious code. Reviewing the revision history of important posts can reveal unauthorized modifications and the user (or lack thereof) associated with them.
Another key indicator is the appearance of new or modified files on your server that were not introduced by legitimate updates or actions. Attackers who achieve code execution often create backdoors or upload malicious scripts to maintain access. Check directories such as wp-content/uploads, wp-content/plugins, or wp-content/themes for unfamiliar PHP files or modifications to existing legitimate files. These files might contain obfuscated code or functions designed for remote command execution.
Reviewing server access logs and WordPress debug logs can also provide clues. Look for unusual patterns of requests, especially to wp-admin/admin-ajax.php or other front-end form processing scripts, originating from unfamiliar IP addresses. A sudden increase in server resource usage, unexpected outbound network connections from your server, or new, unauthorized user accounts in your WordPress database are also strong indicators of compromise.
For command-line checks, you can use grep to search for common malicious functions within your WordPress installation. From your WordPress root directory, run the following command: grep -rE "(eval|base64_decode|shell_exec|system|passthru|exec|assert)" . This command recursively searches all files for common PHP functions often used in malware to execute arbitrary code or decode obfuscated payloads. While wp-cli core verify-checksums can verify the integrity of WordPress core files, it does not cover plugins or themes. For plugins, manual inspection or comparing files against known good versions is often necessary. Regularly backing up your site and comparing file system snapshots can help identify unauthorized changes over time.
How to fix
Access your WordPress administration dashboard.
Navigate to the "Plugins" section.
Locate "Advanced Custom Fields: Extended" or "Advanced Custom Fields: Extended PRO" in the list.
Update the plugin to version 0.9.2.8 or higher as soon as it is available.
Timeline
Date | Event |
|---|---|
2026-10-22 | CVE Published |