Critical ACF Extended Flaw (CVE-2025-13486, CVSS 9.8) Allows Unauthenticated RCE on 100K WordPress Sites

A critical vulnerability in Advanced Custom Fields: Extended (ACF Extended) tracked as CVE-2025-13486 with a CVSS of 9.8 allows unauthenticated remote code execution on more than 100,000 WordPress sites. The flaw exists in the prepare_form() function of the acfe_module_form_front_render class, which renders frontend forms, and stems from using user-supplied data with call_user_func_array to call a callback.

Because input is not validated, an attacker can call arbitrary PHP functions via the form[render] parameter, enabling arbitrary code execution. The vulnerability is untrusted, meaning exploitation requires no login, and researchers warn it can enable privilege escalation and complete site compromise via web shells. The issue was discovered by security researcher dudekmar and reported through the Wordfence Bug Bounty Program, with a bounty of $4,290. Administrators are urged to update to the latest patched version, 0.9.2, of Advanced Custom Fields: Extended.