Advanced Custom Fields: Extended Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Advanced Custom Fields: Extended plugin for WordPress, affecting versions 0.9.0.5 prior to 0.9.1.1. The vulnerability arises in the prepare_form() function, which improperly handles user input by passing it through call_user_func_array(). This flaw allows unauthenticated attackers to execute arbitrary code on the server, potentially leading to the injection of backdoors or the creation of new administrative user accounts.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the potential to inject backdoors or create new administrative user accounts.

Remediation

Users are advised to update the Advanced Custom Fields: Extended plugin to version 0.9.2 or a newer patched version.