Advanced Custom Fields Security Vulnerabilities and Issues — Advanced Custom Fields CVE List

Lucene search

AdvancedcustomfieldsAdvanced Custom Fields

3 matches found

CVE•added 2022/08/22 3:15 p.m.•224 views

CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced i...

8.8CVSS8.7AI score0.01626EPSS

CVE•added 2023/05/02 9:15 a.m.•169 views

CVE-2023-1196

The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.

8.8CVSS8.8AI score0.00334EPSS

CVE•added 2024/06/10 4:15 p.m.•56 views

CVE-2024-34761

Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.

8.5CVSS8.5AI score0.0045EPSS