HIGH
Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Published Jun 20, 2024
7.5
HIGHCVSS 3.1
EPSS 0.43%
Description
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
Affected products
- Vendor n/a Product Advanced Custom Fields (ACF) Defaultunaffected
- Version 0StatusaffectedConstraints<6.3
- Version
- Vendor n/a Product Advanced Custom Fields Pro Defaultunaffected
- Version 0StatusaffectedConstraints<6.3
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Advanced Custom Fields (ACF) | unaffected |
| ||||||
| n/a | Advanced Custom Fields Pro | unaffected |
|
OR
- < 6.3
- < 6.3
-
- Version 0StatusaffectedConstraints<6.3
- Version
-
- Version 0StatusaffectedConstraints<6.3
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Wpengine | Advanced Custom Field Pro | n/a |
| ||||||
| Wpengine | Advanced Custom Fields | n/a |
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (0)
No CWE recorded.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44177 Advisory
- https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/ exploitvdb-entrytechnical-descriptionThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44177 | Advisory | |
| https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/ | exploitvdb-entrytechnical-descriptionThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner WPScan
Published Jun 20, 2024
Updated Aug 27, 2025
Reserved May 6, 2024
Link CVE-2024-4565
CISA Vulnrichment
Updated Jun 20, 2024
ENISA EUVD
EUVD-2024-44177 Assigner WPScan
Published Jun 20, 2024
Updated Aug 27, 2025
Exploited since n/a
Link EUVD-2024-44177