WordPress Advanced Custom Fields plugin 3.1.1 - 6.0.2 - Custom Field Value Exposure vulnerability

2022-10-1800:00:00

Juan Hoffmann

patchstack.com

0.001 Low

EPSS

Percentile

37.2%

JSON

Custom Field Value Exposure Through Parsed Shortcode from User Input vulnerability discovered by Juan Hoffmann in WordPress Advanced Custom Fields plugin (versions 3.1.1 - 6.0.2).

Solution

           Update the WordPress Advanced Custom Fields plugin to the latest available version (at least 6.0.3).

CPENameOperatorVersion
advanced custom fieldsge3.1.1
advanced custom fieldsle6.0.2

CPE	Name	Operator	Version
	advanced custom fields	ge	3.1.1
	advanced custom fields	le	6.0.2

References

www.advancedcustomfields.com/blog/acf-6-0-3-release-security-changes-to-the-acf-shortcode-and-ui-improvements/#acf-shortcode

0.001 Low

EPSS

Percentile

37.2%

JSON

Related for PATCHSTACK:BD9D311515BB184495B0975518D5B4E0