The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Advanced Custom Fields Plugin | — | Update advanced-custom-fields plugin to version 3.5.2, or a newer patched version | Aug 25, 2025 | Jan 3, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub