What the vulnerability does
01Description
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.
Explanation of Vulnerability in Simple Terms
02Summary
Advanced Custom Fields WordPress plugin versions 3.5.1 and earlier contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code on affected sites. The vulnerability requires no user interaction and can be exploited over the network. All sites running this plugin should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site without authentication.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site, including data theft, malware installation, and site defacement.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 5, 2025
CVE published
May 15, 2026
Record updated
