What is the CVSS score of CVE-2025-15463?

CVE-2025-15463 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

ACF Extended CVE-2025-15463

MEDIUM

Code Injection (CWE-94)

2026-05-12 Wordfence

WordPress RCE Code Injection Advanced Custom Fields Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable without credentials or interaction; C:L/I:L reflects impact bounded by available shortcodes, not direct PHP execution; A:N as no availability path exists.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:08 vuln.today

CVE Published

May 12, 2026 - 22:24 nvd

MEDIUM 6.5

DescriptionCVE.org

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

AnalysisAI

Arbitrary shortcode execution in the Advanced Custom Fields: Extended WordPress plugin (all versions through 0.9.2.3) enables unauthenticated remote attackers to invoke any shortcode registered in a WordPress installation by submitting crafted input to exposed front-end forms. The flaw exists in two code paths - the form front-end renderer and the email action handler - both of which pass user-controlled values directly to WordPress's do_shortcode() function without validation or allowlisting. No active exploitation has been identified (SSVC: Exploitation none, not in CISA KEV), and EPSS sits at 0.09% (25th percentile), though the attack is flagged as automatable, raising the potential for opportunistic scanning at scale.

Technical ContextAI

The root cause is CWE-94 (Improper Control of Generation of Code - Code Injection), where externally supplied data is evaluated as executable instruction without sanitization. The affected product is the ACF Extended plugin (CPE: cpe:2.3:a:hwk-fr:advanced_custom_fields:_extended), a widely used extension of the Advanced Custom Fields framework for WordPress. Two specific vulnerable files have been identified in plugin source at version 0.9.2.2: includes/modules/form/module-form-front-render.php at line 35, which handles front-end form rendering, and includes/modules/form/module-form-action-email.php at line 111, which processes email actions triggered by form submissions. In both cases, a value originating from user input reaches WordPress's do_shortcode() without any validation gate, allowing the entire registered shortcode ecosystem of the target site to be invoked externally. The severity of impact is therefore context-dependent: sites with shortcodes that can read database content, expose user data, or trigger plugin actions face materially higher risk than those with only display-oriented shortcodes.

RemediationAI

Update the Advanced Custom Fields: Extended plugin to a version beyond 0.9.2.3. The exact patched release version is not confirmed in the available intelligence data - consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f8544784-1994-47e2-be39-568d0ab9ee00 and the WordPress plugin repository to identify and deploy the current fixed release before upgrading. As an interim compensating control where immediate patching is not feasible, disable or remove any ACF Extended form modules rendered on publicly accessible front-end pages, specifically disabling the front-render and email-action form features, since these are the identified vulnerable code paths; note this may break existing form-based functionality on the site. Deploying a WordPress WAF rule (e.g., via Wordfence Firewall or similar) to detect and block shortcode-like patterns in form submissions can provide an additional layer of defense, but carries a risk of false positives on legitimate shortcode-containing submissions and is not a substitute for patching.