WordPress CVEs

Description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.

Affected WordPress components

• Advanced Custom Fields: Extended Plugin · acf-extended
  Possible match Active
  Before 0.9.2.7
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Advanced Custom Fields: Extended — Before 0.9.2.7

References

• wpscan.com https://wpscan.com/vulnerability/a4a9eab6-3c10-402c-a635-3ae275b12c1d/
• nvd.nist.gov Official NVD record