PT-2024-31718 · WordPress · Advanced Custom Fields Pro

Scott Kingsley Clark · Published 2024-06-20 · Updated 2024-07-17 · CVE-2024-4565

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields (ACF) WordPress plugin versions prior to 6.3 Advanced Custom Fields Pro WordPress plugin versions prior to 6.3

Description: The issue allows displaying custom field values for any post via shortcode without checking for the correct access. This could potentially lead to unauthorized access to sensitive information.

Recommendations: For Advanced Custom Fields (ACF) WordPress plugin versions prior to 6.3, update to version 6.3 or later. For Advanced Custom Fields Pro WordPress plugin versions prior to 6.3, update to version 6.3 or later.

Exploit

Fix

Related Identifiers

CVE-2024-4565

Affected Products

Advanced Custom Fields Pro

References · 5

• 🔥 https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12 · Exploit
• https://osv.dev/vulnerability/CVE-2024-4565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4565 · Security Note
• https://t.me/cvenotify/83813 · Telegram Post
• https://twitter.com/CVEnew/status/1803703995267162326 · Twitter Post