Acf-Extended — PoC Archivehttps://poc.intelseclab.com/tags/acf-extended/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000ACF Extended (ACFE) `prepare_form()` Unauthenticated RCE via Privilege Escalation (CVE-2025-13486)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13486. Status: Weaponized. Affects: Advanced Custom Fields: Extended (ACFE) — WordPress plugin. Tags: wordpress, acf-extended, acfe, call_user_func_array, unauthenticated-rce, privilege-escalation, admin-account-creation, python, cwe-94.webCriticalwordpressacf-extendedacfecall_user_func_arrayunauthenticated-rceprivilege-escalationadmin-account-creationpythoncwe-94Advanced Custom Fields: Extended Unauthenticated Privilege Escalation via `_acf_post_id` Validation Bypass (CVE-2026-8809)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-8809-acf-extended-privilege-escalation/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-8809-acf-extended-privilege-escalation/Critical severity (CVSS 9.8) — web · CVE-2026-8809. Status: PoC. Affects: Advanced Custom Fields: Extended (ACF Extended / "ACFE") WordPress plugin. Tags: wordpress, acf-extended, privilege-escalation, validation-bypass, unauthenticated, administrator-creation.webCriticalwordpressacf-extendedprivilege-escalationvalidation-bypassunauthenticatedadministrator-creation