CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Explanation of Vulnerability in Simple Terms
Advanced Custom Fields PRO does not properly check user permissions before allowing access to certain data. A logged-in user with low privileges can read information they should not have access to. The vulnerability affects versions up to 6.3.1. Update to a version newer than 6.3.1 to resolve this issue.
What an attacker can do
Read sensitive data they should not have access to based on their user role.
Potential impact on your site
Unauthorized users can access private custom field data, potentially exposing sensitive information.
Conditions required to exploit
Attacker must be logged in as a low-privilege user (subscriber, contributor, or similar).
Key dates
External resources
Related vulnerabilities
