CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Explanation of Vulnerability in Simple Terms
Advanced Custom Fields PRO versions up to 6.3.1 lack proper authorization checks on certain operations. A logged-in user with low privileges can read or modify data they should not have access to. The vulnerability requires an active user account but no special interaction. Update to a version newer than 6.3.1.
What an attacker can do
Read or modify data belonging to other users or restricted fields without proper authorization.
Potential impact on your site
Unauthorized users can access or alter custom field data across your site, risking data exposure and integrity.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
