Advanced Custom Fields Pro

Advanced Custom Fields Pro has 18 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2024; all 18 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 9.9 out of 10. Severity breakdown: 1 critical and 2 high. 2024 was the busiest year with 11 disclosures.

The most common weakness is Missing Authorization, behind 7 of the records (39%). Other recurring categories include Cross-Site Scripting, Code Injection.

Every one of the 18 issues recorded for Advanced Custom Fields Pro has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (5) reported by Rafie Muhammad.

01234567891020.01.2021Today20.01.20216.1Advanced Custom Fields Pro <= 5.9.0 - Reflected Cross-Site Scripting CVSS 6.1 · 20.01.202102.12.20216.5Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure CVSS 6.5 · 02.12.20217.5Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure CVSS 7.5 · 02.12.20214.3Advanced Custom Fields <= 5.10 - Missing Authorization on Option Changes CVSS 4.3 · 02.12.202130.03.20226.5Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure CVSS 6.5 · 30.03.202204.05.20236.1Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status' CVSS 6.1 · 04.05.202310.08.20234.4Advanced Custom Fields PRO 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 10.08.202317.01.20246.4Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVSS 6.4 · 17.01.202415.05.20249.9Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Code Injection CVSS 9.9 · 15.05.20248.8Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 15.05.202430.05.20244.3Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access CVSS 4.3 · 30.05.202426.06.20244.3Advanced Custom Fields Pro <= 6.3.1 - Cross-Site Request Forgery CVSS 4.3 · 26.06.20244.3Advanced Custom Fields PRO < 6.3.2 - Missing Authorization CVSS 4.3 · 26.06.20245.4Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization CVSS 5.4 · 26.06.20245.4Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization CVSS 5.4 · 26.06.202404.09.20245.5Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting CVSS 5.5 · 04.09.202407.10.20245.1Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call CVSS 5.1 · 07.10.202415.10.20244.4Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 15.10.2024

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

18

Get automatic notifications for all Advanced Custom Fields Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.9CVE-2024-34761

Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Code Injection

Read the full analysis

Vulnerability Records

18 records
2024-10-15 00:00
Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Advanced Custom Fields Pro
<= 6.3.8
CVE-2024-49593
4.4
Medium
Duc Luong TranYes
2024-10-07 00:00
Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call
Advanced Custom Fields Pro
<= 6.3.8
CVE-2024-9529
5.1
Medium
AutomatticYes
2024-09-04 00:00
Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting
Advanced Custom Fields Pro
<= 6.3.5
CVE-2024-45429
5.5
Medium
Ryo SotoyamaYes
2024-06-26 00:00
Advanced Custom Fields Pro <= 6.3.1 - Cross-Site Request Forgery
Advanced Custom Fields Pro
<= 6.3.1
CVE-2024-37251
4.3
Medium
Rafie MuhammadYes
2024-06-26 00:00
Advanced Custom Fields PRO < 6.3.2 - Missing Authorization
Advanced Custom Fields Pro
< 6.3.2
CVE-2024-37249
4.3
Medium
Rafie MuhammadYes
2024-06-26 00:00
Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization
Advanced Custom Fields Pro
<= 6.3.1
CVE-2024-37250
5.4
Medium
Rafie MuhammadYes
2024-06-26 00:00
Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization
Advanced Custom Fields Pro
<= 6.3.1
CVE-2024-37250
5.4
Medium
Rafie MuhammadYes
2024-05-30 00:00
Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access
Advanced Custom Fields Pro
<= 6.2.10
CVE-2024-4565
4.3
Medium
Francesco CarlucciYes
2024-05-15 00:00
Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Code Injection
Advanced Custom Fields Pro
<= 6.2.9
CVE-2024-34761
9.9
Critical
AnonymousYes
2024-05-15 00:00
Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Local File Inclusion
Advanced Custom Fields Pro
<= 6.2.9
CVE-2024-34762
8.8
High
AnonymousYes
Showing 1–10 of 18 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C