Skip to content
OpenAdvisories

Vendor

wpengine

17 known vulnerabilities.

Products

Advanced Custom Fields PRO 5 Advanced Custom Fields (ACF®) 3 Database Backup for WordPress 3 Better Search Replace 1 faustjs 1 Gutenberg Blocks – ACF Blocks Suite 1 Advanced Custom Fields 1 WP Migrate 1 WP Migrate Lite – Migration Made Easy 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-8382

    Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

    The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f…

    wpengine Advanced Custom Fields (ACF®) Web / CMS
  • Medium 5.3
    CVE-2026-4812

    Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters

    The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that over…

    wpengine Advanced Custom Fields (ACF®) Web / CMS
  • Medium 5.8
    CVE-2025-11427

    WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery

    The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to ma…

    wpengine WP Migrate Lite – Migration Made Easy Web / CMS
  • Medium 4.3
    CVE-2024-37251

    WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.

    wpengine Advanced Custom Fields PRO
  • Medium 5.4
    CVE-2024-37250

    WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability

    Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.

    wpengine Advanced Custom Fields PRO
  • Medium 4.3
    CVE-2024-37249

    WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability

    Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.

    wpengine Advanced Custom Fields PRO
  • Medium 6.3
    CVE-2022-4974

    Freemius SDK <= 2.4.2 - Missing Authorization Checks

    The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_d…

    bPlugins saadiqbal Premmerce nicheaddons Web / CMS
  • Medium 6.4
    CVE-2023-6701

    Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

    The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authe…

    wpengine Delicious Brains Advanced Custom Fields (ACF®) Advanced Custom Fields Pro Web / CMS