ACF Extended PROに認証不要のコード実行脆弱性
Summary
WordPressのプラグインACF Extended PROに、認証なしで任意のWordPress関数を呼び出せる脆弱性が公表されました。0.9.2.6以前を使うサイトは、修正版への更新と、悪用の条件に当てはまるかの確認を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressのプラグインACF Extended PROに、認証なしで任意のWordPress関数を呼び出せる脆弱性が公表されました。0.9.2.6以前を使うサイトは、修正版への更新と、悪用の条件に当てはまるかの確認を進めてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| ACF Extended | Advanced Custom Fields: Extended PRO |
≤ 0.9.2.6 |
— |
Original description The description as published by the source.
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web security@wordfence.com
- web security@wordfence.com
- web nvd.nist.gov
- web github.com