WordPress Plugin Vulnerabilities

Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move

Description

Some of the functions did not have proper capability checks in place, allowing low privilege users such as subscribers to view arbitrary ACF data, movie fields, as well as view field groups.

Affects Plugins

Plugin icon
advanced-custom-fields
Fixed in 5.11
Plugin icon
advanced-custom-fields-pro
Fixed in 5.11

References

CVE
CVE-2021-20865
CVE
CVE-2021-20866
CVE
CVE-2021-20867
URL
https://jvn.jp/en/jp/JVN09136401/
URL
https://wordpress.org/plugins/advanced-custom-fields/#developers

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Keitaro Yamazaki
Submitter
Tom van Miltenburg
Submitter website
https://www.milcraft.nl
Verified
Yes
WPVDB ID
f322619a-e85d-4931-8785-eb9cf30cef7f

Timeline

Publicly Published
2021-08-25 (about 4 years ago)
Added
2021-08-26 (about 4 years ago)
Last Updated
2023-01-27 (about 3 years ago)

Other

Published
Title
Published
2024-02-16
Title
My Private Site < 3.1.0 - Improper Access Control to Sensitive Information Exposure via REST API
Published
2021-04-14
Title
BuddyPress < 7.3.0 - Multiple Authenticated REST API Vulnerabilities
Published
2022-05-18
Title
Jupiter < 6.10.2 - Subscriber+ Arbitrary Plugin Deletion
Published
2024-02-01
Title
ARMember < 4.0.25 - Improper Access Control to Sensitive Information Exposure via REST API
Published
2021-10-05
Title
JobSearch WP Job Board < 1.8.2 - Subscriber+ Add/Update Schedule Calls