CVE-2022-2594CWE-434

CVE-2022-2594: fallo en TODO Advanced Custom Fields

Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Advanced Custom Fields+ Monitorear Advanced Custom Fields Pro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.6%
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
Productos afectados
TODO · Advanced Custom FieldsTODO · Advanced Custom Fields Pro