CVE-2012-10025

The vulnerability is located in the file core/actions/export.php and involves uncontrolled use of the POST parameter acf_abspath to include a PHP file. If the PHP configuration directive allow_url_include is enabled on the server (disabled by default), an attacker can provide a URL in the parameter pointing to a remote malicious PHP file. The server downloads and executes this file in the context of the web server process, leading to complete arbitrary code execution (RCE). The attack requires no authentication.

An attacker can execute arbitrary code in the context of the web server, which in practice means complete takeover of the host — including reading and modifying data, installing backdoors, and lateral movement within the internal network.

The Advanced Custom Fields plugin must be immediately updated to a version higher than 3.5.1 according to information available in the WordPress repository. Regardless of the update, ensure that the allow_url_include directive in the PHP configuration is set to Off, which eliminates the exploitation vector for this specific vulnerability.

WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and all earlier versions; the vulnerability is exploitable only when the PHP directive allow_url_include is enabled (disabled by default).