Advanced Custom Fields < 6.3 – Contributor+ Custom Field Access | CVE 2024-4565

Description

The plugin allows you to display custom field values for any post via shortcode without checking for the correct access

Proof of Concept

1. ADMIN: Install Advanced Custom Fields (or ACF Pro)
2. ADMIN: Create a new field group for posts and add a field to that
3. ADMIN: Fill in content for posts including the ACF custom field and do this to create posts with each status: published, private, password-protected, draft, and trashed
4. CONTRIBUTOR: Add shortcode to any post and specify/guess any post ID (of any status) and ACF field meta key and save
5. CONTRIBUTOR: Preview the post and see the custom field value outputs

1. ADMIN: Install Advanced Custom Fields (or ACF Pro)
2. ADMIN: Create a options page and add a new field group and field to that
3. ADMIN: Fill in content for the options page
4. CONTRIBUTOR: Add shortcode to any post and specify/guess any ACF field option name and save
5. CONTRIBUTOR: Preview the post and see the option value outputs

Example shortcodes:
`[acf post_id="ANY_POST_ID" field="ANY_ACF_META_KEY"]`
`[acf post_id="options" field="ANY_ACF_OPTION_NAME"]`