CVE-2023-40068 Cross-site scripting in Advanced Custom Fields

Medium 5.4 Published 21 Aug 2023 Updated 4 Oct 2024

Authenticated attackers can inject scripts to compromise admin sessions in Advanced Custom Fields, requiring plugin updates.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-40068?

CVE-2023-40068 is a medium-severity cross-site scripting vulnerability in WP Engine Advanced Custom Fields, published on 21 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.

Weakness: CWE-79

Which versions are affected by CVE-2023-40068?

It affects 1 product.

Products include Advancedcustomfields Advanced Custom Fields.

How do I fix CVE-2023-40068?

No fix has been published for CVE-2023-40068 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-40068 being exploited?

There is no known exploitation of CVE-2023-40068 in the wild and no public exploit code.

Sources

Also known as GHSA-87x7-f7g8-6px2.