Vulnerability feed

Executive summary

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins, versions 0.9.2.4 through 0.9.2.7, are affected by a flaw that does not consistently disable shortcode processing. The advisory rates it medium severity with a CVSS score of 4.8, and the fix is to update to version 0.9.2.8.

Technical summary

The weakness is classified as injection (OWASP A1), caused by the plugins not consistently disabling shortcode processing. The advisory does not state the attack vector, required privileges, or user interaction needed to exploit it. Affected versions are 0.9.2.4 to 0.9.2.7 and the fixed version is 0.9.2.8 for both acf-extended and acf-extended-pro. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild. The advisory text also lists unrelated vulnerability titles from other plugins, which are not part of this advisory's affected products.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/52f1633a-21ae-…73-8f24-5c10c2a92a8b

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affects

Advanced Custom FieldsAdvanced Custom Fields ExtendedAdvanced Custom Fields Extended PRO

Executive summary

The Advanced Custom Fields: Extended WordPress plugin and its PRO version, both before 0.9.2.8, contain a privilege escalation flaw. The advisory describes this as a high severity issue with a CVSS score of 8.1, and the fix is to update to version 0.9.2.8.

Technical summary

The flaw is classified as CWE-269 (improper privilege management) and as a privilege escalation issue, where the plugin does not resolve the target of an operation. The advisory does not state the exact attack vector or the specific preconditions beyond the affected versions, though the CVSS score of 8.1 (high) is given. Affected versions are listed as before 0.9.2.8 for both acf-extended and acf-extended-pro, and the fixed version is 0.9.2.8. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/eccfab3c-e7cc-…23-9c20-4cd6c32f8422

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Advanced Custom FieldsAdvanced Custom Fields ExtendedAdvanced Custom Fields Extended PRO

Executive summary

The Advanced Custom Fields: Extended WordPress plugin and its PRO version are affected by a flaw before version 0.9.2.8 that lets attackers run code on affected websites. The advisory rates it as critical with a CVSS score of 9.0, and the fix is to update to version 0.9.2.8 or later.

Technical summary

The advisory classifies this as a remote code execution flaw (CWE-94, code injection) caused by the plugins not performing any capability check. The advisory does not state the required privilege level or other preconditions for exploitation, and it does not state the attack vector beyond the description. Affected versions are listed as before 0.9.2.8 for both acf-extended and acf-extended-pro, and the fixed version is 0.9.2.8. The advisory does not state any workaround, and it gives no detection guidance. The advisory also states it was verified and lists a CVSS score of 9.0 (critical), but it does not state exploitation in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/9c8f45c1-cd85-…9c-be77-88801d8143ce

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Advanced Custom FieldsAdvanced Custom Fields ExtendedAdvanced Custom Fields Extended PRO

Executive summary

The Advanced Custom Fields: Extended WordPress plugin and its PRO version are affected by a cross-site scripting flaw. The advisory rates it medium severity with a CVSS score of 6.8, and the fix is to update to version 0.9.2.8.

Technical summary

The flaw is cross-site scripting (CWE-79) caused by the plugin not validating or escaping some input. The advisory does not state the attack vector, required privileges, or user interaction details beyond the CWE and the OWASP A7 classification. Affected versions are listed as before 0.9.2.8 for both acf-extended and acf-extended-pro, and the fixed version is 0.9.2.8. No workaround is stated. No detection guidance is stated, and whether the flaw is exploited in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/4475b8a6-0d25-…b2-b973-5e19b8958595

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affects

Advanced Custom FieldsAdvanced Custom Fields ExtendedAdvanced Custom Fields Extended PRO

Executive summary

The Advanced Custom Fields: Extended WordPress plugin and its PRO version, both before 0.9.2.8, are affected by a flaw that lets a requester bypass authorization checks. The advisory rates it 8.1 (high) and states that the fix is version 0.9.2.8.

Technical summary

The flaw is classified as incorrect authorization (CWE-863, OWASP A5 Broken Access Control) because the plugin does not verify that the requester is authorized to perform an action. The advisory's excerpt is truncated, so the attack vector and required privileges are not fully stated in the text provided. Affected versions are listed as before 0.9.2.8 for both acf-extended and acf-extended-pro, and the fixed version is 0.9.2.8. The advisory does not state any workaround or detection guidance. Related entries in the advisory describe unrelated plugins and are not treated as affected by this CVE.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/3634e73f-df12-…84-8bf6-c098efa0b191

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Advanced Custom FieldsAdvanced Custom Fields ExtendedAdvanced Custom Fields Extended PRO