100,000 WordPress Sites Affected by Remote Code Execution Vulnerability in ACF: Extended Plugin

ProBuilders · Dec 3, 2025

How can a year end without something like this?

Please update your sites, if you use ACF: Extended

https://www.wordfence.com/blog/2025...nced-custom-fields-extended-wordpress-plugin/

contact_yeasin · Dec 3, 2025

My sites are safe, though. But this is a matter of concern

onlyzorro · Dec 4, 2025

ProBuilders said:
How can a year end without something like this?

Please update your sites, if you use ACF: Extended

https://www.wordfence.com/blog/2025...nced-custom-fields-extended-wordpress-plugin/

Extended should update the plugin immediately remote code execution can let attackers take control.

ProBuilders · Dec 4, 2025

onlyzorro said:
Extended should update the plugin immediately remote code execution can let attackers take control.

It was already updated. Wordfence and other companies take vulnerability reporting seriously.

When they got the bug notification, they contact the author first and only when the author confirms a patch is their analysis revealed.

Bandiz · Dec 4, 2025

wow, few weeks ago my website public_html was fully wiped out.. didn't understood what happened. Restored it with backup and after few days someone changed my site to some random html template without any info. Now saw this thread and checked what plugins I use and it seem I got this one

100,000 WordPress Sites Affected by Remote Code Execution Vulnerability in ACF: Extended Plugin

ProBuilders

Power Member

contact_yeasin

Junior Member

onlyzorro

Junior Member

ProBuilders

Power Member

Bandiz

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World