CVE-2021-24865

CVE-2021-24865: Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection

Vendor Unknown
Product Advanced Custom Fields: Extended
Weakness CWE-89 · SQLi
Published January 24, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue

Key dates

02Disclosure timeline

January 24, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-10155 Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection CVE-2023-3419 tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection CVE-2025-14257 itsourcecode Student Management System newrecord.php sql injection CVE-2025-54294 Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla CVE-2025-5370 PHPGurukul News Portal forgot-password.php sql injection