WordPress security by component

Advanced Custom Fields: Extended

Plugin description

Advanced Custom Fields: Extended is a WordPress component with 1 published CVE record in this archive. The latest tracked vulnerability was published Dec 03, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: advanced-custom-fields-extended

Latest vulnerability

CVE-2025-13486: Advanced Custom Fields: Extended: Code execution

Advanced Custom Fields: Extended is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

PublishedDec 03, 2025

Safe version guidanceSee mitigation notes

		Safe version
Dec 03, 2025	CVE-2025-13486 Advanced Custom Fields: Extended: Code execution Advanced Custom Fields: Extended is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.8 NVDPending