100,000 WordPress Sites Affected by Remote Code Execution Vulnerability in ACF: Extended Plugin

[ProBuilders]

How can a year end without something like this?

Please update your sites, if you use ACF: Extended

https://www.wordfence.com/blog/2025...nced-custom-fields-extended-wordpress-plugin/

 

[contact_yeasin]

My sites are safe, though. But this is a matter of concern

 

[onlyzorro]

How can a year end without something like this?

Please update your sites, if you use ACF: Extended

https://www.wordfence.com/blog/2025...nced-custom-fields-extended-wordpress-plugin/

Extended should update the plugin immediately remote code execution can let attackers take control.

 

[ProBuilders]

Extended should update the plugin immediately remote code execution can let attackers take control.

It was already updated. Wordfence and other companies take vulnerability reporting seriously.

When they got the bug notification, they contact the author first and only when the author confirms a patch is their analysis revealed.

 

[Bandiz]

wow, few weeks ago my website public_html was fully wiped out.. didn't understood what happened. Restored it with backup and after few days someone changed my site to some random html template without any info. Now saw this thread and checked what plugins I use and it seem I got this one