CVE-2024-4565 Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Contributors can read custom field values from any post via shortcode due to missing access checks in the Advanced Custom Fields plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4565?
CVE-2024-4565 is a high-severity missing authorization vulnerability in Unknown Advanced Custom Fields (ACF), published on 20 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
Which versions are affected by CVE-2024-4565?
It affects 1 product.
Products include Advancedcustomfields Advanced Custom Fields.
How do I fix CVE-2024-4565?
No fix has been published for CVE-2024-4565 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-4565 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4565 exists.
Other vulnerabilities in Unknown Advanced Custom Fields (ACF)
- CVE-2023-1196 Advanced Custom Fields - Contributor+ PHP Object Injection
- CVE-2022-2594 Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload
- CVE-2021-20865 Missing authorization in Advanced Custom Fields and Advanced Custom Fields Pro
- CVE-2023-30777 WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
- CVE-2024-9529 Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
Sources
Also known as GHSA-6x2p-g636-5378.