PT-2022-9485 · WordPress · Advanced Custom Fields: Extended

Jrxnm + 1 · Published 2022-01-24 · Updated 2022-01-27 · CVE-2021-24865

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended WordPress plugin versions prior to 0.8.8.7

Description The issue arises from the lack of validation of the order and orderby parameters before they are used in a SQL statement, leading to a SQL Injection issue.

Recommendations For versions prior to 0.8.8.7, update to version 0.8.8.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL statement or validating the order and orderby parameters manually until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24865

Affected Products

Advanced Custom Fields: Extended

References · 5

• 🔥 https://wpscan.com/vulnerability/055a2dcf-77ec-4e54-be7d-9c47f7730d1b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24865 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24865 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2648200 · Patch
• https://t.me/cibsecurity/36114 · Telegram Post