{"vulnerability": "CVE-2025-13486", "sightings": [{"uuid": "7c9008ea-26de-4f08-8574-52e0dd32954e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3m72t76etwr2w", "content": "", "creation_timestamp": "2025-12-03T06:26:19.606940Z"}, {"uuid": "b70882d0-70a5-421d-ab10-067275656606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://gist.github.com/Darkcrai86/e33aafa739bcd6db6807ceb739a3d483", "content": "", "creation_timestamp": "2025-12-03T08:00:26.000000Z"}, {"uuid": "413a5fcb-fb1d-4cbb-8991-993322b4c3ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-13486", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/115654590660895053", "content": "", "creation_timestamp": "2025-12-03T08:03:24.911451Z"}, {"uuid": "e5a59f0b-eae5-43d6-99cf-8f2746fd00db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-13486", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m72ymsiswn2g", "content": "", "creation_timestamp": "2025-12-03T08:03:25.638835Z"}, {"uuid": "953d2046-2cf1-4df4-affa-71e42a50cadf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m732eckzc22q", "content": "", "creation_timestamp": "2025-12-03T08:34:27.851152Z"}, {"uuid": "fe1a7435-be90-4026-9aa9-936b76823b8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-13486", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3m757uhw6s32r", "content": "", "creation_timestamp": "2025-12-04T05:18:18.289575Z"}, {"uuid": "248a26ab-ccf9-461f-b530-f7fd3558c3b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m76umtrkhy2b", "content": "", "creation_timestamp": "2025-12-04T21:02:39.513430Z"}, {"uuid": "155eac8a-648c-4cc7-b538-6b5d771d709e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3maelnigasr2f", "content": "", "creation_timestamp": "2025-12-19T21:03:11.706097Z"}, {"uuid": "38b487e3-f73c-4712-8524-e4cdba15fc22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_acf_extended_rce.rb", "content": "", "creation_timestamp": "2025-12-18T22:13:06.000000Z"}, {"uuid": "fef23ea6-00a3-47fa-9bc4-ce13d7db5dbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/61913", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aAdvanced Custom Fields Extended (ACFE) WordPress Plugin Exploit RCE - Admin Creation\nURL\uff1ahttps://github.com/0xgh057r3c0n/CVE-2025-13486\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-12-06T13:59:46.000000Z"}, {"uuid": "905aeb52-b9bf-4bff-a7f7-9683bd1d1767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "Telegram/-BSo0zA61vWCA4Jhqv9IkIbnyI3oU0cuabSJHE6-K1C6zFk", "content": "", "creation_timestamp": "2025-12-19T15:05:16.000000Z"}, {"uuid": "1a2f5f0f-6b5e-4ab5-be13-24177f4ba4e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "Telegram/p1kctDWMPjRH9UHDphPObPnl4Jga04s8GR_gza3noeTXcn4", "content": "", "creation_timestamp": "2025-12-04T15:00:08.000000Z"}, {"uuid": "65c92061-d122-4085-95af-a6d04bfe7350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "Telegram/d1qJqLxVXfmX2tDEguuny-SmZQucZglbuvctPOWUAOgRGig", "content": "", "creation_timestamp": "2025-12-04T09:00:05.000000Z"}, {"uuid": "ffdff2dc-d550-429f-8128-1ebd4e9c682c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "Telegram/PvVlKU5mouDrQkucYBVA45d4PI3zxJLZNVLfukuzHyAN8nc", "content": "", "creation_timestamp": "2025-12-05T03:00:07.000000Z"}, {"uuid": "5652cba5-34a1-4059-9b24-881b694b3d5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/61692", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aDocker test environment for CVE-2025-13486 (ACF Extended RCE). For security research only.\nURL\uff1ahttps://github.com/KrE80r/cve-2025-13486-vuln-setup\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-12-04T23:32:58.000000Z"}, {"uuid": "dc6d6347-c452-43a7-87dd-742da224d262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "https://t.me/realcodeb0ss/206", "content": "Shodan \u2014> http.html:\"/wp-content/plugins/acf-extended/\"\n\nFofa \u2014> body=\"/wp-content/plugins/acf-extended/\"\n\nPublicWWW \u2014> \"/wp-content/plugins/acf-extended/\"", "creation_timestamp": "2025-12-05T23:02:53.000000Z"}, {"uuid": "1ce3c1a0-bb9d-4957-8b29-353449248032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/61580", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aVulnerable setup for CVE-2025-13486 - Advanced Custom Fields: Extended - Remote Code Execution \nURL\uff1ahttps://github.com/0xnemian/CVE-2025-13486.-CVE-2025-13486\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-12-04T06:22:28.000000Z"}, {"uuid": "dc1a78ec-d335-43fb-a5ca-ed503378d95e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/61591", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aPOC for CVE-2025-13486 \nURL\uff1ahttps://github.com/0xanis/CVE-2025-13486-POC\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-12-04T08:11:12.000000Z"}, {"uuid": "1afe4875-0963-4969-b7d0-6b49ebf0db3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-13486", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_acf_extended_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Marcin Dudek (dudekmar) - CERT.PL\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated Remote Code Execution vulnerability in the\\n          Advanced Custom Fields: Extended (ACF Extended) WordPress plugin versions 0.9.0.5\\n          through 0.9.1.1. The vulnerability exists in the prepare_form() function of the\\n          acfe_module_form_front_render class, which accepts user-controlled input via the\\n          form[render] parameter and passes it directly to call_user_func_array() without\\n          proper sanitization.\\n\\n          This exploit requires a WordPress page containing an ACF Extended form widget, which\\n          exposes the required nonce token in the page's JavaScript. The NONCE_PAGE option\\n          must be set to the path of such a page.\\n\\n          Once an administrator account is created via wp_insert_user(), the module uploads\\n          and executes a malicious plugin to achieve remote code execution (RCE).\", \"disclosure_date\": \"2025-12-02\", \"fullname\": \"exploit/multi/http/wp_acf_extended_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"WordPress ACF Extended Unauthenticated RCE via prepare_form()\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_acf_extended_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_acf_extended_rce\", \"references\": [\"CVE-2025-13486\", \"URL-https://www.wordfence.com/blog/2025/12/100000-wordpress-sites-affected-by-remote-code-execution-vulnerability-in-advanced-custom-fields-extended-wordpress-plugin/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:20.411801Z"}]}