KrE80r/cve-2025-13486-vuln-setup

GitHubRepository PoCScanner

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Docker-based test environment for CVE-2025-13486. It sets up a vulnerable WordPress instance with ACF Extended 0.9.0.5 and provides instructions for testing the vulnerability using a Nuclei template. The artifact itself does not contain exploit code; it only configures a target and references an external scanner (Nuclei).

Backdoor review

No backdoor observed in reviewed code

The repository is a Docker-based test environment for CVE-2025-13486. All reviewed scripts (entrypoint.sh, download-plugins.sh, Dockerfile) and documentation (README.md) perform only expected setup actions: downloading vulnerable plugin versions, installing WordPress, and configuring a test nonce exposure. No concealed executable behavior, credential exfiltration, persistence mechanisms, or unrelated payloads were observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesShellDockerfileMarkdown
Target softwareWordPressAdvanced Custom Fields: Extended
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a scanner because its primary purpose is to set up a vulnerable environment for testing and then instruct the user to run an external scanner (Nuclei) to check for the vulnerability. The README explicitly states 'nuclei -t CVE-2025-13486.yaml -u http://localhost:8888' as the testing command. The provided curl commands in the README are for manual verification of the vulnerability's presence, not for exploitation. The artifact does not contain any code that autonomously exploits the vulnerability to achieve code execution or other impact.

README.md:1README.md:15README.md:33-38

Requirements

  • Requires Docker and Docker Compose to build and run the environment.README.md:12
  • Requires the vulnerable ACF Extended plugin (version 0.9.0.5) and its dependency ACF Pro to be placed in the plugins directory.README.md:22-28
  • Requires the Nuclei scanner and its CVE-2025-13486.yaml template to perform the actual vulnerability check.README.md:15

Observed behavior

  • Builds a Docker container running WordPress with PHP 7.4 and Apache.Dockerfile:1
  • Downloads the vulnerable ACF Extended plugin version 0.9.0.5.download-plugins.sh:7-8
  • Installs WordPress, the ACF Pro dependency, and the vulnerable ACF Extended plugin inside the container.entrypoint.sh:48-71
  • Modifies the active theme's functions.php to expose the ACF nonce on the frontend, simulating a real-world vulnerable site.entrypoint.sh:89-112
  • Provides manual curl commands to extract the nonce and send a crafted POST request to the vulnerable AJAX endpoint, demonstrating the vulnerability check.README.md:33-38
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Test Environment Modification
entrypoint.sh appends PHP code to the active theme's functions.php to expose ACF nonces on all pages.This is explicitly documented as a test-only simulation of real-world sites that have ACFE forms deployed. It is not a backdoor; it enables the PoC exploit to function in a minimal WordPress setup.entrypoint.sh:74-116
Credential Disclosure
Default WordPress admin credentials admin/admin123 are set in entrypoint.sh.These are hardcoded test credentials for a local Docker environment, not a concealed backdoor. They are disclosed in the README and entrypoint output.entrypoint.sh:51-52README.md:14
Review boundaries

What the analysis did not establish

  • The evidence packet reports 3 unclassified files (out of 7 total) that were not included as text, so the full artifact content is not available for analysis.
  • The Nuclei template file (CVE-2025-13486.yaml) referenced in the README is not included in the provided evidence.
  • The analysis is based solely on the supplied text files; no code was executed to confirm behavior.
  • Three text files (docker-compose.yml, .env, CVE-2025-13486.yaml) were present in the repository but not included in the evidence packet. Their content was not reviewed.
  • Binary analysis was not performed; no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2025-13486Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that deploys a MySQL 8.0 database and a custom WordPress container with ACF Extended 0.9.0.5, intended as a testbed for CVE-2025-13486.

docker-compose.yml:1-55README.md:1-52

Lab assessment

Vulnerability lab

The README explicitly states the environment is for testing CVE-2025-13486, a critical unauthenticated RCE in ACF Extended. The Dockerfile and entrypoint script install the vulnerable plugin version and configure the lab for exploit testing.

README.md:1-3README.md:47-52entrypoint.sh:68-72
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database server

MySQL 8.0 container providing the WordPress database, configured with root and wordpress user credentials.

docker-compose.yml:2-18

wordpress

vulnerable web applicationexploit target

Custom WordPress container built from wordpress:php7.4-apache, with WP-CLI, a custom entrypoint that installs WordPress, ACF Pro, and the vulnerable ACF Extended 0.9.0.5, and injects code to expose the ACF nonce for testing.

docker-compose.yml:20-44Dockerfile:1-16entrypoint.sh:1-132

custom-entrypoint.sh

setup automationvulnerability enabler

Entrypoint script that waits for the database, installs WordPress and the vulnerable plugins, and injects code into the active theme's functions.php to expose the ACF nonce on all frontend pages, simulating a real-world vulnerable site.

entrypoint.sh:1-132
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-13486

Supported by supplied evidence

The environment is explicitly built to test CVE-2025-13486. The README describes the vulnerability as unauthenticated RCE in ACF Extended 0.9.0.5, and the entrypoint installs that exact version and configures the lab to expose the necessary nonce.

README.md:1-3README.md:47-52entrypoint.sh:68-72
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • ACF Pro plugin zip file must be placed in plugins/ directory (or free ACF alternative).README.md:17-22entrypoint.sh:60-65
  • ACF Extended 0.9.0.5 plugin zip file must be placed in plugins/ directory.README.md:24-26entrypoint.sh:68-72
  • Docker and Docker Compose must be installed to build and run the environment.README.md:7-9

Evidence-described exercise path

  1. Download required plugins using download-plugins.sh or manually place them in plugins/.README.md:7-9download-plugins.sh:1-21
  2. Start the environment with docker-compose up -d --build.README.md:10-11
  3. Wait for the WordPress container to become healthy (indicated by /tmp/.vuln-setup-ready).docker-compose.yml:39-44entrypoint.sh:120
  4. Extract the ACF nonce from the homepage using curl and grep.README.md:30-31
  5. Send a crafted POST request to admin-ajax.php with the nonce and malicious form parameters to trigger RCE.README.md:33-35
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The entrypoint script injects code into the theme to expose the ACF nonce, but this is explicitly documented as necessary for the vulnerability exercise and does not escape the container or target external systems. No host compromise, persistence, credential theft, or backdoor behavior is observed.

entrypoint.sh:75-112README.md:30-35
Review boundaries

What the analysis did not establish

  • The packet does not include the actual plugin zip files (acf-pro.zip, acf-extended.zip), so the vulnerable code cannot be inspected.
  • The nuclei template CVE-2025-13486.yaml referenced in the README is not included.
  • The download-plugins.sh script fetches ACF Extended from an external URL, but the script is not executed by the Docker build or compose; it is a manual prerequisite.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1