Advanced Custom Fields
Monthly
Unauthenticated attackers can invoke arbitrary WordPress functions with attacker-controlled arguments through the render_field method in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6. Exploitation is not unconditional: it requires either the non-default 'shortcode_preview' setting to be enabled on the targeted form, or a server environment lacking OpenSSL functions so that ACF Pro's acf_decrypt falls back to unverified base64 decoding - default installations with shortcode_preview disabled and OpenSSL present are not exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-reported severity is critical and the priority decision is act_now, so exposed sites running the PRO plugin should be triaged promptly.
Sensitive information exposure in the Advanced Custom Fields: Extended WordPress plugin (all versions up to and including 0.9.2.7) lets an unauthenticated remote attacker read the WordPress password hash of any user by submitting a {get_user} template tag through a form field that the plugin resolves and stores as a publicly readable term name. The flaw is only reachable on sites where an administrator has deliberately published a page containing an [acfe_form] shortcode with a Term action that maps a field to the term name via a save.name field mapping - a supported but non-default configuration; sites without such a public form are not exposed. Severity is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with high confidentiality impact only; it is not listed in CISA KEV and no public exploit has been identified at time of analysis, and the vendor has released 0.9.2.8 with the fix.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. A publicly available proof-of-concept from WPScan exists and a vendor patch is available at version 0.9.2.7.
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9.2.5 allows remote attackers to create new administrator-level accounts on vulnerable sites. The flaw stems from the after_validate_save_post() function trusting an attacker-controlled POST parameter to bypass role allow-list and capability validation when a public ACFE frontend form with a Create User action is exposed. With a CVSS 9.8 and no public exploit identified at time of analysis, the vulnerability presents a direct site-takeover path on affected configurations.
Arbitrary file deletion in the Novarain/Tassos Framework system plugin (plg_system_nrframework) and the suite of Tassos.gr Joomla extensions that bundle it lets remote unauthenticated attackers delete arbitrary files on affected sites. The CVSS 4.0 vector (PR:N/UI:N) and the 'Authentication Bypass' tag indicate no credentials or interaction are needed, and the high integrity/availability impact reflects that deleting core files such as Joomla's configuration.php can lead to denial of service or site takeover. There is no public exploit identified at time of analysis, and EPSS is low (0.07%, 21st percentile) with no CISA KEV listing, indicating no observed exploitation despite the critical 9.3 base score.
The Advanced Custom Fields: Extended WordPress plugin, in every release up to and including 0.9.2.7, registers multiple AJAX handlers for unauthenticated visitors (wp_ajax_nopriv_*) that perform no current_user_can() capability check, so remote attackers with no account can invoke server-side actions and read data they should not see. The only gate is ACF's acf_verify_ajax() nonce validation, and because guest nonces (acf_nonce) are printed into the source of any frontend page containing an ACF form, an attacker can simply scrape a valid nonce and pass the check, disclosing post titles and internal Flexible Content layout structures. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact); there is no CISA KEV entry and no public exploit identified at time of analysis, and this is a moderate-severity information-disclosure issue rather than a critical emergency, though sites on 0.9.2.4 through 0.9.2.7 remain exposed because the 0.9.2.4 fix was only partial.
Unauthenticated attackers can permanently delete arbitrary WordPress media library attachments through the Advanced Custom Fields: Extended plugin (hwk-fr) in all versions up to and including 0.9.2.6, because the Email form action fails to verify that the submitted attachment ID belongs to the submitter or that the user holds any capability. The attack surface is narrow: exploitation only works on sites where an administrator has published a public-facing ACFE form whose Email action attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled, and the attacker must supply a valid numeric attachment ID. No public exploit has been identified at time of analysis, and the assessed impact is limited to integrity and availability of media attachments (no disclosure, no code execution), which is why the assessed vector carries AC:H and the priority signal places remediation within this month rather than immediately.
Improper shortcode handling in the Advanced Custom Fields: Extended and ACF Extended PRO WordPress plugins (versions 0.9.2.4 through 0.9.2.7) allows unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a front-end form whose stored configuration lacks the setting that disables shortcode processing in the confirmation message. Exploitation is conditional on the site publishing such a form, an attacker-uncontrolled precondition reflected by the high attack complexity; where that condition holds, no credentials or user interaction beyond a normal submission are needed. The impact is bounded to shortcodes registered on the target site rather than true arbitrary code execution, and the vendor has released a fix in 0.9.2.8; only a public PoC reference exists and it is not verified as working exploit code, with no confirmed active exploitation (CISA KEV) and this month's priority label.
Broken access control in the Advanced Custom Fields: Font Awesome Field WordPress plugin (versions up to and including 6.1.1) permits contributor-level authenticated users to perform privileged operations beyond their intended role. The CWE-862 root cause indicates the plugin fails to enforce proper authorization checks before executing certain functionality, allowing lower-privileged users to read data or invoke actions restricted to higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector and low privilege requirement make this exploitable by any user with a contributor account on affected WordPress installations.
Stored Cross-Site Scripting in Advanced Custom Fields: Font Awesome plugin for WordPress up to version 5.0.2 allows authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via insufficiently validated JSON field values in the update_preview() function, resulting in script execution whenever any user visits an affected page. The vulnerability requires user interaction only in the sense that a victim must visit a page containing injected content; the attacker needs only Subscriber-level authentication to craft the malicious payload.
Arbitrary shortcode execution in the Advanced Custom Fields: Extended WordPress plugin (all versions through 0.9.2.3) enables unauthenticated remote attackers to invoke any shortcode registered in a WordPress installation by submitting crafted input to exposed front-end forms. The flaw exists in two code paths - the form front-end renderer and the email action handler - both of which pass user-controlled values directly to WordPress's do_shortcode() function without validation or allowlisting. No active exploitation has been identified (SSVC: Exploitation none, not in CISA KEV), and EPSS sits at 0.09% (25th percentile), though the attack is flagged as automatable, raising the potential for opportunistic scanning at scale.
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).1.1 through 6.0.2. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Anders Thorborg.4.12. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can invoke arbitrary WordPress functions with attacker-controlled arguments through the render_field method in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6. Exploitation is not unconditional: it requires either the non-default 'shortcode_preview' setting to be enabled on the targeted form, or a server environment lacking OpenSSL functions so that ACF Pro's acf_decrypt falls back to unverified base64 decoding - default installations with shortcode_preview disabled and OpenSSL present are not exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-reported severity is critical and the priority decision is act_now, so exposed sites running the PRO plugin should be triaged promptly.
Sensitive information exposure in the Advanced Custom Fields: Extended WordPress plugin (all versions up to and including 0.9.2.7) lets an unauthenticated remote attacker read the WordPress password hash of any user by submitting a {get_user} template tag through a form field that the plugin resolves and stores as a publicly readable term name. The flaw is only reachable on sites where an administrator has deliberately published a page containing an [acfe_form] shortcode with a Term action that maps a field to the term name via a save.name field mapping - a supported but non-default configuration; sites without such a public form are not exposed. Severity is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with high confidentiality impact only; it is not listed in CISA KEV and no public exploit has been identified at time of analysis, and the vendor has released 0.9.2.8 with the fix.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Unauthenticated administrator account takeover in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 is possible when a site exposes a front-end user-update form configured to target an administrator account with a visitor-supplied password field. The plugin's Forms module skips the authorization check on who may edit the targeted account unless the submitted role is administrator or super_admin, creating a gap exploitable by any site visitor. A publicly available proof-of-concept from WPScan exists and a vendor patch is available at version 0.9.2.7.
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9.2.5 allows remote attackers to create new administrator-level accounts on vulnerable sites. The flaw stems from the after_validate_save_post() function trusting an attacker-controlled POST parameter to bypass role allow-list and capability validation when a public ACFE frontend form with a Create User action is exposed. With a CVSS 9.8 and no public exploit identified at time of analysis, the vulnerability presents a direct site-takeover path on affected configurations.
Arbitrary file deletion in the Novarain/Tassos Framework system plugin (plg_system_nrframework) and the suite of Tassos.gr Joomla extensions that bundle it lets remote unauthenticated attackers delete arbitrary files on affected sites. The CVSS 4.0 vector (PR:N/UI:N) and the 'Authentication Bypass' tag indicate no credentials or interaction are needed, and the high integrity/availability impact reflects that deleting core files such as Joomla's configuration.php can lead to denial of service or site takeover. There is no public exploit identified at time of analysis, and EPSS is low (0.07%, 21st percentile) with no CISA KEV listing, indicating no observed exploitation despite the critical 9.3 base score.
The Advanced Custom Fields: Extended WordPress plugin, in every release up to and including 0.9.2.7, registers multiple AJAX handlers for unauthenticated visitors (wp_ajax_nopriv_*) that perform no current_user_can() capability check, so remote attackers with no account can invoke server-side actions and read data they should not see. The only gate is ACF's acf_verify_ajax() nonce validation, and because guest nonces (acf_nonce) are printed into the source of any frontend page containing an ACF form, an attacker can simply scrape a valid nonce and pass the check, disclosing post titles and internal Flexible Content layout structures. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact); there is no CISA KEV entry and no public exploit identified at time of analysis, and this is a moderate-severity information-disclosure issue rather than a critical emergency, though sites on 0.9.2.4 through 0.9.2.7 remain exposed because the 0.9.2.4 fix was only partial.
Unauthenticated attackers can permanently delete arbitrary WordPress media library attachments through the Advanced Custom Fields: Extended plugin (hwk-fr) in all versions up to and including 0.9.2.6, because the Email form action fails to verify that the submitted attachment ID belongs to the submitter or that the user holds any capability. The attack surface is narrow: exploitation only works on sites where an administrator has published a public-facing ACFE form whose Email action attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled, and the attacker must supply a valid numeric attachment ID. No public exploit has been identified at time of analysis, and the assessed impact is limited to integrity and availability of media attachments (no disclosure, no code execution), which is why the assessed vector carries AC:H and the priority signal places remediation within this month rather than immediately.
Improper shortcode handling in the Advanced Custom Fields: Extended and ACF Extended PRO WordPress plugins (versions 0.9.2.4 through 0.9.2.7) allows unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a front-end form whose stored configuration lacks the setting that disables shortcode processing in the confirmation message. Exploitation is conditional on the site publishing such a form, an attacker-uncontrolled precondition reflected by the high attack complexity; where that condition holds, no credentials or user interaction beyond a normal submission are needed. The impact is bounded to shortcodes registered on the target site rather than true arbitrary code execution, and the vendor has released a fix in 0.9.2.8; only a public PoC reference exists and it is not verified as working exploit code, with no confirmed active exploitation (CISA KEV) and this month's priority label.
Broken access control in the Advanced Custom Fields: Font Awesome Field WordPress plugin (versions up to and including 6.1.1) permits contributor-level authenticated users to perform privileged operations beyond their intended role. The CWE-862 root cause indicates the plugin fails to enforce proper authorization checks before executing certain functionality, allowing lower-privileged users to read data or invoke actions restricted to higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector and low privilege requirement make this exploitable by any user with a contributor account on affected WordPress installations.
Stored Cross-Site Scripting in Advanced Custom Fields: Font Awesome plugin for WordPress up to version 5.0.2 allows authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via insufficiently validated JSON field values in the update_preview() function, resulting in script execution whenever any user visits an affected page. The vulnerability requires user interaction only in the sense that a victim must visit a page containing injected content; the attacker needs only Subscriber-level authentication to craft the malicious payload.
Arbitrary shortcode execution in the Advanced Custom Fields: Extended WordPress plugin (all versions through 0.9.2.3) enables unauthenticated remote attackers to invoke any shortcode registered in a WordPress installation by submitting crafted input to exposed front-end forms. The flaw exists in two code paths - the form front-end renderer and the email action handler - both of which pass user-controlled values directly to WordPress's do_shortcode() function without validation or allowlisting. No active exploitation has been identified (SSVC: Exploitation none, not in CISA KEV), and EPSS sits at 0.09% (25th percentile), though the attack is flagged as automatable, raising the potential for opportunistic scanning at scale.
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).1.1 through 6.0.2. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Anders Thorborg.4.12. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.