CVE Database /
CVE-2012-10025
CVE
CVE-2012-10025 — Advanced Custom Fields (ACF®) [advanced-custom-fields] < 3.5.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2012-10025
|
Advanced Custom Fields (ACF®) [advanced-custom-fields] < 3.5.2 |
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') |
Unknown
|
< 3.5.2
|
3.5.2 |
2013-01-03 |
—
|
CVE-2012-10025
Advanced Custom Fields versions up to 3.5.1 suffer from a remote file inclusion flaw in the export.php file that allows unauthenticated attackers to execute arbitrary code when PHP's allow_url_include setting is turned on. An attacker can manipulate the acf_abspath POST parameter to load and run malicious PHP from remote servers, potentially gaining complete control of the affected web server. The vulnerability was fixed in version 3.5.2.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings