[ad_1]
Lacking authorization vulnerability …permits a distant authenticated attacker to view the data on the database with out the entry permission. This type of vulnerability permits an attacker to achieve entry to the positioning at ranges which can be ordinarily restricted to customers with admin privileges.
Superior Customized Fields (ACF) WordPress Plugin
The ACF WordPress plugin is a well-liked growth instrument that permits builders so as to add customized fields to the Edit display screen in addition to to customise the sections for customers, posts, media and different areas.
The ACF instrument permits builders to increase WordPress themes in some ways, which explains why there are hundreds of thousands of energetic installations.
Lacking Authorization Vulnerability
A lacking authorization vulnerability occurs when a software program like a WordPress plugin doesn’t test for authorization of a consumer when accessing particular info.
Any such vulnerability can result in publicity of delicate info and distant code execution assaults.
Distant Authenticated Attacker
This explicit vulnerability exploits a lacking authorization test for customers who’ve some degree of authentication.
That signifies that customers with a minimum of editor, writer or contributor degree of authentication can entry admin degree privilege to be able to view database info.
Based on probably the most present info from the Japan Laptop Emergency Repsonse Group Coordination Heart:
“WordPress Plugin “Superior Customized Fields” supplied by Scrumptious Brains comprises a lacking authorization vulnerability…
Customers of this product (Editor, Writer, Contributor) might view the data on the database with out the entry permission.”
America Nationwide Vulnerability Database has assigned it a CVE reference quantity, CVE-2022-23183
ACF Changelog
A changelog is a log detailing all of the adjustments in every model of a software program.
It’s tough to inform which of the adjustments detailed within the changelog are associated to fixing the vulnerability as a result of the ACF changelog doesn’t explicitly say that one thing is a safety repair, it simply labels them as a “Repair.”
The changelog for the ACF WordPress plugin doesn’t explicitly be aware {that a} safety challenge was addressed.
A part of the ACF changelog merely states:
“Repair – ACF now validates entry to choice web page subject values when accessing through subject keys the identical method as subject names. View Extra
Repair – REST API now appropriately validates fields for POST replace requests”
The “View Extra” hyperlink results in an explainer on the ACF web site that claims:
“…Calls to get_field() or the_field() on non-ACF WordPress choices may even return null. Nevertheless, utilizing these features to retrieve any submit, consumer or time period meta will return the worth, no matter if the meta is an ACF subject.
…In ACF 5.12.1, these restrictions now additionally appropriately apply when utilizing a subject key to entry an choice worth, the identical as utilizing the sphere title.”
“Utilizing ACF Capabilities to Retrieve Knowledge From Exterior ACF.”
Superior Customized Fields Vulnerability is Patched
The ACF vulnerability impacts all variations previous to Superior Customized Fields 5.12.1 and Superior Customized Fields Professional 5.12.1.
The Japan Laptop Emergency Response Group Coordination Heart recommends all customers of the plugin to replace instantly to the ACF variations 5.12.1.
[ad_2]
