Unauthenticated Remote Code Execution in Advanced Custom Fields: Extended WordPress Plugin

A critical unauthenticated remote code execution vulnerability has been identified in the Advanced Custom Fields: Extended plugin for WordPress, affecting versions 0.9.0.5 through 0.9.1.1. The flaw resides in the prepare_form() function, which improperly handles user input by passing it directly to call_user_func_array(), enabling attackers to execute arbitrary code on the server without authentication. This vulnerability allows threat actors to inject backdoors, create new administrative accounts, and potentially take full control of affected WordPress sites.

Security researchers warn that exploitation of this vulnerability could lead to complete compromise of website integrity and confidentiality, including data theft and malware installation. Administrators are strongly advised to update the plugin to a secure version, implement Zero Trust security models, enable multi-factor authentication for admin accounts, and harden PHP configurations. The vulnerability is mapped to MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter) and T1190 (Exploit Public-Facing Application).