nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-4565 CVE-2024-4565
HIGH
Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Record summary
CVE-2024-4565 has a selected CVSS score of 7.5 (high).
Description
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 20, 2024 · Source: CVE List
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
Advanced Custom Fields (ACF)Default status: unaffected | CVE List | Before 6.3 | affected |
Advanced Custom Fields ProDefault status: unaffected | CVE List | Before 6.3 | affected |
advanced_custom_field_proBrowse wpengine / advanced_custom_field_proDefault status: unknown | CVE List | Before 6.3 | affected |
advanced_custom_fieldsBrowse wpengine / advanced_custom_fieldsDefault status: unknown | CVE List | Before 6.3 | affected |
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12