Description
This module exploits an unauthenticated Remote Code Execution vulnerability in the Advanced Custom Fields: Extended (ACF Extended) WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepare_form() function of the acfe_module_form_front_render class, which accepts user-controlled input via the form[render] parameter and passes it directly to call_user_func_array() without proper sanitization.
This exploit requires a WordPress page containing an ACF Extended form widget, which exposes the required nonce token in the page's JavaScript. The NONCE_PAGE option must be set to the path of such a page.
Once an administrator account is created via wp_insert_user(), the module uploads and executes a malicious plugin to achieve remote code execution (RCE).
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/wp/acf_extended_rcemsf undefined(acf_extended_rce) > show actions ...actions...msf undefined(acf_extended_rce) > set ACTION < action-name >msf undefined(acf_extended_rce) > show options ...show and set options...msf undefined(acf_extended_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub