漏洞描述
WordPresss acf-to-rest-ap through 3.1.0 allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that can read sensitive information in the wp_options table such as the login and pass values.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
gist.github.comhttps://gist.github.com/mariuszpoplwski/4fbaab7f271bea99c733e3f2a4bafbb5↗wordpress.orghttps://wordpress.org/plugins/acf-to-rest-api/#developers↗github.comhttps://github.com/airesvsg/acf-to-rest-api↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-13700↗github.comhttps://github.com/ARPSyndicate/cvemon↗