Description

WordPress Plugin Advanced Custom Fields (ACF) is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently view the information on the database. WordPress Plugin Advanced Custom Fields (ACF) version 5.12 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.12.1 or latest

References

https://jvn.jp/en/jp/JVN42543427/index.html

Related Vulnerabilities

Dotclear Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2016-9268)

ATutor Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-1583)

WordPress Plugin Coming Soon Multiple Vulnerabilities (1.1.18)

TYPO3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2010-3662)

Python Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2018-1000117)

Severity

High

Classification

CVE-2022-23183 CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass