Description
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Advanced Custom Fields: Extended | 0.9.2.4 – < 0.9.2.8 | 0.9.2.8 |
| — | Advanced Custom Fields: Extended PRO | 0.9.2.4 – < 0.9.2.8 | 0.9.2.8 |
References
- https://wpscan.com/vulnerability/52f1633a-21ae-4273-8f24-5c10c2a92a8b/ exploit vdb-entry technical-description