Marcin Dudek (dudekmar) - CERT.PL

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

WordPress ACF Extended Unauthenticated RCE via prepare_form()

Metasploit exploitby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2025-12-09ExploitCVE-2025-134861 file

exploit_multi/http/wp_acf_extended_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-13486, an unauthenticated remote code execution vulnerability in the ACF Extended WordPress plugin. It leverages the prepare_form() function's unsafe use of call_user_func_array() via the form[render] parameter to create an administrator account, then uploads and executes a malicious plugin for RCE.

Backdoor review

No backdoor observed in reviewed code

The module exploits CVE-2025-13486 to create an admin user and upload a Metasploit-generated plugin for RCE. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareWordPressAdvanced Custom Fields: Extended plugin
Attack typescode injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's primary purpose is to exploit CVE-2025-13486 by creating an admin user and deploying a payload for remote code execution. It includes complete exploit logic: nonce extraction, malicious request construction, admin creation, authentication, plugin upload, and payload execution.

modules/exploits/multi/http/wp_acf_extended_rce.rb:104-111modules/exploits/multi/http/wp_acf_extended_rce.rb:128-144modules/exploits/multi/http/wp_acf_extended_rce.rb:158-172

Requirements

  • A WordPress site with the vulnerable ACF Extended plugin (versions 0.9.0.5 through 0.9.1.1) and a page containing an ACF Extended form widget to expose the nonce token.modules/exploits/multi/http/wp_acf_extended_rce.rb:22-31

Observed behavior

  • Sends a POST request to wp-admin/admin-ajax.php with action 'acfe/form/render_form_ajax' and form[render] set to 'wp_insert_user' to create a new WordPress administrator account.modules/exploits/multi/http/wp_acf_extended_rce.rb:128-144
  • Logs in with the newly created administrator credentials, then uploads a malicious plugin ZIP file and triggers its execution by requesting the plugin's PHP file.modules/exploits/multi/http/wp_acf_extended_rce.rb:146-172
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldCore exploit step to create an administrator account, matching the vulnerability description.modules/exploits/multi/http/wp_acf_extended_rce.rb:137-141
Payload Deployment
Payload withheldStandard Metasploit post-auth RCE technique; the plugin is generated by the framework, not hardcoded.modules/exploits/multi/http/wp_acf_extended_rce.rb:162-171
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full exploit chain (e.g., generate_plugin, wordpress_upload_plugin) is not visible.
  • The evidence does not include any execution output or verification that the exploit works against a live target.
  • Framework mixins (e.g., wordpress_upload_plugin, generate_plugin) are not expanded; their behavior is assumed to match standard Metasploit conventions.
  • Binary files are flagged as metadata-only and not analyzed, but none are present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.