Monitor free

Report

New Known

Exploited

Fixed

WordPress Advanced Custom Fields PRO premium plugin <= 5.12.2 - Unauthenticated File Upload vulnerability

5.3

CVSS 3.1 score Medium severity

Report

Monitoring Monitoring Known to be exploited Coming soon

Find out about vulnerable plugins in your websites for free.

Scan your website

Software

Advanced Custom Fields PRO

Type

Plugin

Vulnerable versions

<= 5.12.2

Fixed in

5.12.3

PSID

268d25659413

CVE ID

CVE-2022-2594

Classification

Other Vulnerability Type

OWASP Top 10

A1: Injection

Required privilege

Can be exploited remotely without any authentication.

Credits

James Golovich

Publicly disclosed

2022-08-01

Patchstack vPatch available since

09.12.2021

Details

Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields PRO premium plugin (versions <= 5.12.2).

Solution

Update the WordPress Advanced Custom Fields PRO plugin to the latest available version (at least 5.12.3).

References