Advanced Custom Fields: Extended PRO allows remote code execution
This WordPress site plugin can let attackers take over your site without logging in!
Summary
A missing input check in the render_field function of the Advanced Custom Fields: Extended PRO WordPress plugin lets an unauthenticated attacker call arbitrary WordPress functions with chosen arguments. All versions up to and including 0.9.2.6 are affected, and attacks work when an administrator enables the non-default shortcode_preview setting or when the server lacks OpenSSL functions.
Affected when
- non-default shortcode_preview setting enabled
- server lacks OpenSSL functions
What to do
Check that the plugin runs a version newer than 0.9.2.6 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen