CVE-2021-24865: falha em Advanced Custom Fields: Extended
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.5%
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Produtos afetados
Unknown · Advanced Custom Fields: ExtendedCVEs relacionadas — Advanced Custom Fields: Extended
No mesmo produto, das mais perigosas para as menos.
CVE-2026-94267CRITICALAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionEPSS 0.4%CVE-2026-80467HIGHAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert ActionEPSS 0.4%CVE-2026-12526HIGHAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.4%CVE-2026-94268HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%CVE-2026-94264MEDIUMAdvanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode AttributesEPSS 0.3%CVE-2026-94262HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%