Lucene search

K
wpvulndbScott Kingsley ClarkWPVDB-ID:430224C4-D6E3-4CA8-B1BC-B2229A9BCF12
HistoryMay 30, 2024 - 12:00 a.m.

Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

2024-05-3000:00:00
Scott Kingsley Clark
wpscan.com
5
advanced custom fields custom field access poc software update

9.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

Description The plugin allows you to display custom field values for any post via shortcode without checking for the correct access

PoC

1. ADMIN: Install Advanced Custom Fields (or ACF Pro) 2. ADMIN: Create a new field group for posts and add a field to that 3. ADMIN: Fill in content for posts including the ACF custom field and do this to create posts with each status: published, private, password-protected, draft, and trashed 4. CONTRIBUTOR: Add shortcode to any post and specify/guess any post ID (of any status) and ACF field meta key and save 5. CONTRIBUTOR: Preview the post and see the custom field value outputs 1. ADMIN: Install Advanced Custom Fields (or ACF Pro) 2. ADMIN: Create a options page and add a new field group and field to that 3. ADMIN: Fill in content for the options page 4. CONTRIBUTOR: Add shortcode to any post and specify/guess any ACF field option name and save 5. CONTRIBUTOR: Preview the post and see the option value outputs Example shortcodes: [acf post_id="ANY_POST_ID" field="ANY_ACF_META_KEY"] [acf post_id="options" field="ANY_ACF_OPTION_NAME"]

CPENameOperatorVersion
eq6.3
eq6.3

9.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

Related for WPVDB-ID:430224C4-D6E3-4CA8-B1BC-B2229A9BCF12