ACF City Selector
ACF City Selector has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. ACF City Selector is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-31832ACF City Selector <= 1.16.0 - Unauthenticated Sensitive Information Exposure
Read the full analysisVulnerability Records
ACF City Selector
Author
Beee
ACF City Selector is an extension for Advanced Custom Fields which creates a new field where you can select a city, depending on country and province/state. Added field 3 select options * country * state/province * city Plugin website https://acf-city-selector.com
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C