Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via…
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The Advanced Custom Fields: Extended plugin for WordPress is affected. Under certain configurations, unauthenticated visitors could extract sensitive data, including user password hashes, which would then be publicly readable.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. Exploitation requires that an administrator has configured a public [acfe_form] shortcode page with a Term action using a save.name field mapping — a supported and documented configuration.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- hwk-fr Advanced Custom Fields: Extended
through 0.9.2.7
References 9
plugins.trac.wordpress.org
- browser/acf-extended/tags/0.9.2.7/includes/modules/form/module-form-action-term.php#L287
- browser/acf-extended/tags/0.9.2.7/includes/modules/form/module-form-action-term.php#L227
- browser/acf-extended/tags/0.9.2.7/includes/modules/form/module-form-action-term.php#L337
- browser/acf-extended/tags/0.9.2.7/includes/template-tags.php#L609
- browser/acf-extended/tags/0.9.2.7/includes/template-tags.php#L1053
- browser/acf-extended/tags/0.9.2.7/includes/modules/form/module-form-front.php#L62
- changeset?reponame=&new=3754818%40acf-extended%2Ftags%2F0.9.2.8&old=3667996%40acf-extended%2Ftags%2F0.9.2.7
- changeset/3754818/acf-extended/trunk/includes/modules/form/module-form-action-term.php