WordPress Plugin Vulnerabilities

Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

Description

The plugin allows you to display custom field values for any post via shortcode without checking for the correct access

Proof of Concept

1. ADMIN: Install Advanced Custom Fields (or ACF Pro)
2. ADMIN: Create a new field group for posts and add a field to that
3. ADMIN: Fill in content for posts including the ACF custom field and do this to create posts with each status: published, private, password-protected, draft, and trashed
4. CONTRIBUTOR: Add shortcode to any post and specify/guess any post ID (of any status) and ACF field meta key and save
5. CONTRIBUTOR: Preview the post and see the custom field value outputs

1. ADMIN: Install Advanced Custom Fields (or ACF Pro)
2. ADMIN: Create a options page and add a new field group and field to that
3. ADMIN: Fill in content for the options page
4. CONTRIBUTOR: Add shortcode to any post and specify/guess any ACF field option name and save
5. CONTRIBUTOR: Preview the post and see the option value outputs

Example shortcodes:
`[acf post_id="ANY_POST_ID" field="ANY_ACF_META_KEY"]`
`[acf post_id="options" field="ANY_ACF_OPTION_NAME"]`

Affects Plugins

References

Classification

Type
ACCESS CONTROLS
CWE

Miscellaneous

Original Researcher
Scott Kingsley Clark
Submitter
Scott Kingsley Clark
Submitter website
Verified
Yes

Timeline

Publicly Published
2024-05-30 (about 1 months ago)
Added
2024-05-30 (about 1 months ago)
Last Updated
2024-05-30 (about 1 months ago)

Other