Important Vulnerability on Advanced Custom Fields Plugin for WordPress

We are issuing this security advisory regarding a vulnerability discovered in the AI-Bolit component of Imunify products. A patch for this vulnerability was released on October 23, 2025, and has already been automatically deployed to the vast majority of servers.

Here at Imunify, we're always monitoring web data at scale - and we've noticed a clear trend: legitimate AI bots, like those from Meta, Apple, OpenAI, and other reputable organizations, are increasingly behaving aggressively, excessively consuming server resources, and often ignoring instructions in files like robot.txt.

These sorts of issues caused by AI-powered bots can severely impact both website performance and resource efficiency.

To assist hosting providers and website owners in effectively managing these aggressive bots, we’ve created specialized ModSecurity rule sets designed to precisely and effectively block significant AI bot traffic for some of the most popular AI modules.

Having a safe website to advertise and visit is one of the policies that website owners should adhere to when running ad campaigns with Google Ads. 'Compromise Website' is one of the policies that will cause an ads campaign on a website to be disapproved. This essentially means that the website has been hacked or compromised somehow, making it unsafe for users.