CVE-2023-3957

Name of the Vulnerable Software and Affected Versions ACF Photo Gallery Field plugin for WordPress versions up to, and including, 1.9

Description The issue allows authenticated attackers with subscriber-level permissions or above to modify data unauthorizedly due to insufficient restrictions on the apg profile update function. This enables them to update user metas arbitrarily, with the meta value limited to a string.

Recommendations For versions up to, and including, 1.9, consider disabling the apg profile update function until a patch is available to prevent unauthorized modification of user metas. Restrict access to user meta updates to minimize the risk of exploitation.