CVE-2012-10025 WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion
CriticalCVSS 10.0
EPSS 2.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Advanced Custom Fields WordPress Plugin | <= 3.5.1 | No fix listed |
| wordpress advanced-custom-fields(WordPress) | < 3.5.2 | 3.5.2 |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- web.archive.org exploit technical-description
- www.tenable.com third-party-advisory
- www.wordfence.com third-party-advisory
- wpscan.com third-party-advisory
- wordpress.org product
- www.vulncheck.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org