ACF Extended CVE-2025-15463

The target WordPress installation must have the ACF Extended plugin (version ≤ 0.9.2.3) installed and active. The plugin's form module must be actively deployed with at least one form rendered on a publicly accessible front-end page; the vulnerability is triggered through the front-render module (module-form-front-render.php:35) or the email action handler (module-form-action-email.php:111). No authentication is required (CVSS PR:N), and no user interaction from a victim is needed (UI:N). Exploitation is constrained by the shortcode ecosystem available on the target site - sites where only benign, display-only shortcodes are registered face materially lower practical impact than those where shortcodes expose data retrieval or administrative capabilities. WordPress installations where ACF Extended forms are not deployed on any public-facing page are not exploitable via this vector.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly captures the network-accessible, zero-authentication attack surface with partial confidentiality and integrity impact. The capped C:L/I:L scores reflect that the attacker does not directly achieve arbitrary PHP code execution - impact is bounded by what the target site's registered shortcodes can do, which varies significantly across WordPress deployments. EPSS at 0.09% (25th percentile) is low, indicating that exploitation has not been observed at meaningful scale relative to other vulnerabilities in the NVD corpus. SSVC confirms Exploitation: none and Technical Impact: partial, consistent with the bounded harm model. However, SSVC also flags the attack as Automatable: yes - low complexity and no authentication mean mass-scanning tooling could trivially probe all internet-exposed ACF Extended forms. The 'RCE' tag in the metadata is potentially misleading: shortcode execution is not equivalent to arbitrary PHP code execution unless specific shortcodes (e.g., from other plugins) expose such capability. Defenders should audit which shortcodes are registered in their environment before relying on the CVSS impact score alone. No KEV listing and no POC were present in the available data, supporting the low urgency assessment, but the automatable nature warrants patching on a routine rather than deferred schedule.

An unauthenticated attacker scans for WordPress sites running ACF Extended and identifies a page with a publicly accessible ACFE form. The attacker submits a POST request with a crafted field value containing a shortcode such as [some-sensitive-shortcode], which the plugin's form renderer or email handler passes directly to do_shortcode(), causing server-side execution. Depending on the shortcodes registered in the target environment - for example, those from other plugins that expose user data, settings, or administrative functions - the attacker can extract information or trigger unintended actions without ever authenticating.