JVN#09136401: Multiple missing authorization vulnerabilities in WordPress Plugin "Advanced Custom Fields"

WordPress Plugin “Advanced Custom Fields” provided by Delicious Brains contains multiple missing authorization vulnerabilities listed below.

Missing authorization related to database browsing (CWE-862) - CVE-2021-20865

Missing authorization related to user list obtaining (CWE-862) - CVE-2021-20866

Missing authorization related to field group movement (CWE-862) - CVE-2021-20867

Impact

A user with a lower level of authority than Editor role (such as Subscriber, Contributor, Author roles) may:

• View the information on the database without the access permission - CVE-2021-20865
• Obtain a list of information without the access permission - CVE-2021-20866
• Move the field group without the usage permission - CVE-2021-20867

Solution

Update the plugin
Update the plugin according to the information provided by the developer.
The developer has released the versions listed below that address the vulnerabilities.

• Advanced Custom Fields 5.11
• Advanced Custom Fields Pro 5.11

Products Affected

• Advanced Custom Fields versions prior to 5.11
• Advanced Custom Fields Pro versions prior to 5.11