advanced_custom_fields 漏洞

低危2026/01/14

Advanced Custom Fields (ACF) - Full Path Disclosure

Advanced Custom Fields (ACF) for WordPress contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation.

advanced_custom_fieldsPoC 已收录

CVSS—

中危CVE-2023-307772023/05/05

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the post_status parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

advanced_custom_fieldsPoC 已收录

CVSS6.1EPSS 88.7%

advanced_custom_fields

关联漏洞

Advanced Custom Fields (ACF) - Full Path Disclosure

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting