CVE-2012-10025

Description

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.

Reserved 2025-08-05 | Published 2025-08-05 | Updated 2025-08-05 | Assigner VulnCheck

Problem types

CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Product status

Default status
unaffected

*
affected

Credits

Charlie Eriksen finder

References

raw.githubusercontent.com/..._advanced_custom_fields_exec.rb exploit

www.exploit-db.com/exploits/23856 exploit

web.archive.org/...26/http://secunia.com:80/advisories/51037 technical-description exploit

www.tenable.com/plugins/nessus/63326 third-party-advisory

www.wordfence.com/...ode-execution-via-remote-file-inclusion third-party-advisory

wpscan.com/...rability/d132d93b-509c-490d-8001-87147ed28c5e/ third-party-advisory

wordpress.org/plugins/advanced-custom-fields/ product

www.vulncheck.com/...ced-custom-fields-remote-file-inclusion third-party-advisory

cve.org (CVE-2012-10025)

nvd.nist.gov (CVE-2012-10025)

Download JSON