CVE-2012-10025: WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allowurlinclude is enabled (default: Off), an unauthenticated attacker can exploit the acfabspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-10025?
CVE-2012-10025 is considered a critical vulnerability due to the potential for remote file inclusion leading to unauthenticated access.
How do I fix CVE-2012-10025?
To fix CVE-2012-10025, update the Advanced Custom Fields plugin to version 3.5.2 or later.
Who is affected by CVE-2012-10025?
Users of the Advanced Custom Fields plugin version 3.5.1 and below on WordPress installations are affected by CVE-2012-10025.
What type of vulnerability is CVE-2012-10025?
CVE-2012-10025 is a remote file inclusion (RFI) vulnerability.
Can CVE-2012-10025 be exploited remotely?
Yes, CVE-2012-10025 can be exploited remotely if the allow_url_include directive is enabled in the PHP configuration.