Advanced Forms for ACF < 1.9.3.3 - Missing Authorization to Unauthenticated Form Settings Export

2024-02-0500:00:00

wpscan.com

wordpress

acf plugin

unauthorized access

data vulnerability

capability check

unauthenticated attackers

form settings.

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.5%

JSON

Description The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings.