CVE-2021-20865 Missing authorization in Advanced Custom Fields and Advanced Custom Fields Pro

What is CVE-2021-20865?

CVE-2021-20865 is a high-severity missing authorization vulnerability in Delicious Brains Advanced Custom Fields and Advanced Custom Fields Pro, published on 13 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.

Weakness: CWE-862

Which versions are affected by CVE-2021-20865?

It affects 1 product.

Products include Advancedcustomfields Advanced Custom Fields.

How do I fix CVE-2021-20865?

No fix has been published for CVE-2021-20865 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-20865 being exploited?

There is no known exploitation of CVE-2021-20865 in the wild and no public exploit code.

Other vulnerabilities in Delicious Brains Advanced Custom Fields and Advanced Custom Fields Pro

• CVE-2023-1196 Advanced Custom Fields - Contributor+ PHP Object Injection High 8.8
• CVE-2022-2594 Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload High 8.8
• CVE-2024-4565 Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access High 7.5
• CVE-2023-30777 WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2024-9529 Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f2fc-p952-6xf6.