PT-2023-16812 · WordPress · Advanced Custom Fields Pro

Nguyen Huu Do

·

CVE-2023-1196

·

Published

2023-05-02

·

Updated

2023-05-08

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Advanced Custom Fields (ACF) Free and Pro WordPress plugins versions 5.x through 5.12.4 Advanced Custom Fields (ACF) Free and Pro WordPress plugins versions 6.x through 6.0.x
Description The issue allows users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present, due to the unserialize of user controllable data.
Recommendations For versions 5.x through 5.12.4, update to version 5.12.5 or later. For versions 6.x through 6.0.x, update to version 6.1.0 or later.

Exploit

Fix

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-1196

Affected Products

Advanced Custom Fields Pro