Advanced Custom Fields (ACF), CVE-2012-10025

CVE, Research URL: CVE-2012-10025
Home page URL: Security reports for Advanced Custom Fields (ACF)
Application: Advanced Custom Fields (ACF)
Published on: Aug 06, 2025
Research Description: The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.
Affected versions: Min -, max 3.5.2.
Status: vulnerable