CVE-2023-1196

HIGH

Advanced Custom Fields 5.0.0-5.12.5 and 6.x < 6.1.0 - Authenticated PHP Object Injection via Unsafe Unserialization

Title source: llm
STIX 2.1

Description

The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.

References (2)

Core 2
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/cf376ca2-92f6-44ff-929a-ace809460a33
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/8e5ec88e-0e66-44e4-bbf2-74155d849ede

Scores

CVSS v3 8.8
EPSS 0.0108
EPSS Percentile 60.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (1)
advancedcustomfields/advanced_custom_fields 5.0.0 - 5.12.5
Published May 02, 2023
Tracked Since Feb 18, 2026