CVE-2012-10025: Advanced Custom Fields WordPress Plugin

Critical severity, CVSS 10.0. EPSS: 1.8% chance of exploitation in the next 30 days.

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.

Affected products

• Advanced Custom Fields WordPress Plugin: up to and including 3.5.1

Published 2025-08-05. Last modified 2026-06-16.