CVE-2012-10025

CRITICAL

ACF <3.5.1 - RCE

Title source: llm

Description

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/23856
metasploit WORKING POC EXCELLENT
rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb

References (8)

Scores

CVSS v4 10.0
EPSS 0.5018
EPSS Percentile 97.8%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

CWE
CWE-98
Status published
Products (1)
Advanced Custom Fields/WordPress Plugin < 3.5.1
Published Aug 05, 2025
Tracked Since Feb 18, 2026