454 matches found
CVE-2023-30777
CVE-2023-30777 Generador de URL de Prueba de Concepto PoC para una vulnerabilidad XSS reflejado en el plugin Advanced Custom Fields de WordPress. PoC generado por: Alucard0x1 Crédito del Exploit:...
CVE-2025-13486
🔴 CVE-2025-13486 - Exploit del Plugin de WordPress Advanced Custom Fields Extended ACFE 📋 Resumen Exploit de prueba de concepto para CVE-2025-13486 , una vulnerabilidad crítica en el plugin de WordPress Advanced Custom Fields: Extended ACFE que permite la Ejecución Remota de Código que conduce a ...
CVE-2025-13486
Explotación Masiva CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Ejecución Remota de Código No Autenticada en prepareform ⚠️ Detalles de la Vulnerabilidad El plugin Advanced Custom Fields: Extended para WordPress es vulnerable a la Ejecución Remota de Código en las versiones...
Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution
Advanced Custom Fields: Extended WordPress plugin 0.9.0.5 through 0.9.1.1 contains a remote code execution caused by unsafe use of calluserfuncarray in prepareform function, letting unauthenticated attackers execute arbitrary code remotely. id: CVE-2025-13486 info: name: Advanced Custom Fields...
CVE-2026-12526
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
EUVD-2026-69846
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
CVE-2026-12526
The Advanced Custom Fields: Extended WordPress plugin (versions before 0.9.2.7 ) contains an unauthenticated administrator account takeover vulnerability in its front-end Forms module . The root cause is a failure to verify if a requester is authorized to edit the targeted user account during the...
CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
PT-2026-84603
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super admin. On ...
CVE-2026-12526: Improper Authentication
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
CVE-2026-80467: Improper Privilege Management
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
Vulnerability of the prepare_form() function in the acfe_module_form_front.render plugin: This vulnerability allows a hacker to execute arbitrary code.
Vulnerability of the prepareform function in the acfemoduleformfront.render method of the Advanced Custom Fields plugin: This vulnerability is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2026-66678
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
EUVD-2026-53892
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
CVE-2026-66678
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
CVE-2026-66678 WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
CVE-2026-66678
CVE-2026-66678 concerns a Broken Access Control issue in the WordPress plugin Advanced Custom Fields: Font Awesome Field , affecting versions up to and including 6.1.1 . The connected sources consistently describe the vulnerability class and affected plugin/version but do not provide technical de...
WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.2...