CVE-2022-2594CWE-434

Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload

published August 22, 2022

CVSS
—
EPSS
2%
Percentile
76.1
In the wild
Unconfirmed
What it is

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01633 · 76.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-08-22T15:05Z
EPSS history
Timeline
  • 22 AUG 15:05Z
    Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload
    cvelistv5