CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
Explanation of Vulnerability in Simple Terms
Advanced Custom Fields Pro versions before 6.2.10 contain a code injection vulnerability that allows authenticated users with low privileges to run arbitrary PHP code on the site. The vulnerability requires high attack complexity but can affect the entire site when exploited. Site administrators should update immediately to version 6.2.10 or later.
What an attacker can do
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
A low-privilege user can compromise the entire site, including reading/modifying data and taking control.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., contributor or subscriber role).
Key dates
External resources
Related vulnerabilities
