What is CVE-2025-54940?

CVE-2025-54940 is a low-severity vulnerability in Wpengine, Inc. Advanced Custom Fields, classified under Code Injection. CVSS score: 3.4/10. Published 2025-08-08.

How severe is CVE-2025-54940?

Low severity. CVSS v3 base score is 3.4 out of 10.

RCE in Wpengine, Inc. Advanced Custom Fields

CVE-2025-54940

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.002 (11.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.4 (Low). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N.

Affected products

Wpengine, Inc. Advanced Custom Fields — versions prior to 6.4.3

Weakness classification (CWE)

CWE-94 — Code Injection

References

vultures@jpcert.or.jp
vultures@jpcert.or.jp

Frequently asked questions

What is CVE-2025-54940?: CVE-2025-54940 is a low-severity vulnerability in Wpengine, Inc. Advanced Custom Fields, classified under Code Injection. CVSS score: 3.4/10. Published 2025-08-08.
How severe is CVE-2025-54940?: Low severity. CVSS v3 base score is 3.4 out of 10.