PT-2023-16812 · WordPress · Advanced Custom Fields Pro

Nguyen Huu Do · Published 2023-05-02 · Updated 2023-05-08 · CVE-2023-1196

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields (ACF) Free and Pro WordPress plugins versions 5.x through 5.12.4 Advanced Custom Fields (ACF) Free and Pro WordPress plugins versions 6.x through 6.0.x

Description The issue allows users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present, due to the unserialize of user controllable data.

Recommendations For versions 5.x through 5.12.4, update to version 5.12.5 or later. For versions 6.x through 6.0.x, update to version 6.1.0 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-1196

Affected Products

Advanced Custom Fields Pro

References · 5

• 🔥 https://wpscan.com/vulnerability/cf376ca2-92f6-44ff-929a-ace809460a33 · Exploit
• 🔥 https://wpscan.com/vulnerability/8e5ec88e-0e66-44e4-bbf2-74155d849ede · Exploit
• https://osv.dev/vulnerability/CVE-2023-1196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1196 · Security Note
• https://t.me/cvenotify/49973 · Telegram Post