Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

2024-05-3000:00:00

Scott Kingsley Clark

advanced custom fields

contributor+

custom field access

poc

june 13 2024

exploit

9.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin allows you to display custom field values for any post via shortcode without checking for the correct access

1. ADMIN: Install Advanced Custom Fields (or ACF Pro)
2. ADMIN: Create a new field group for posts and add a field to that
3. ADMIN: Fill in content for posts including the ACF custom field and do this to create posts with each status: published, private, password-protected, draft, and trashed
4. CONTRIBUTOR: Add shortcode to any post and specify/guess any post ID (of any status) and ACF field meta key and save
5. CONTRIBUTOR: Preview the post and see the custom field value outputs

1. ADMIN: Install Advanced Custom Fields (or ACF Pro)
2. ADMIN: Create a options page and add a new field group and field to that
3. ADMIN: Fill in content for the options page
4. CONTRIBUTOR: Add shortcode to any post and specify/guess any ACF field option name and save
5. CONTRIBUTOR: Preview the post and see the option value outputs

Example shortcodes:
`[acf post_id="ANY_POST_ID" field="ANY_ACF_META_KEY"]`
`[acf post_id="options" field="ANY_ACF_OPTION_NAME"]`