Advanced Custom Fields: Extended vulnerabilities
4 known vulnerabilities in Advanced Custom Fields: Extended from Hwk-fr. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Advanced Custom Fields: Extended: Exposure of Sensitive Information to an Unauthorized Actor
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including th
- 9.8 Critical severity
Advanced Custom Fields: Extended: Improper Privilege Management
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting
- 9.8 Critical severity
Advanced Custom Fields: Extended: Improper Privilege Management
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it pos
- 9.8 Critical severity
Advanced Custom Fields: Extended: Improper Control of Generation of Code
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_