CVE-2022-23183

MEDIUM

Advanced Custom Fields < 5.12.1 - Authenticated Missing Authorization

Title source: llm

Description

Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.

References (3)

Core 3

Core References

Product, Vendor Advisory x_refsource_misc

https://www.advancedcustomfields.com/

Product, Third Party Advisory x_refsource_misc

https://wordpress.org/plugins/advanced-custom-fields/

Third Party Advisory x_refsource_misc

https://jvn.jp/en/jp/JVN42543427/index.html

Scores

CVSS v3 6.5

EPSS 0.0144

EPSS Percentile 69.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-862

Status published

Products (1)

advancedcustomfields/advanced_custom_fields < 5.12.1 (2 CPE variants)

Published Mar 31, 2022

Tracked Since Feb 18, 2026