Advanced Custom Fields <= 5.7.11 - PHP Object Injection
2019-02-15 00:00
Slavco MihajloskiStrategic Overview
StatusPatched in 5.7.12
Affected PluginAdvanced Custom Fields (ACF®)
Affected Version
<= 5.7.11CVSS5.4Medium
CVE
N/AVulnerability Overview
Advanced Custom Fields before 5.7.12 fails to sanitize user-supplied input before passing it to the unserialize() function. This allows low-level authenticated users to call PHP Objects and possibly achieve remote code execution if a usable gadget is present in a plugin or theme installed on the same site as the vulnerable plugin.
Technical Analysis
REMEDIATION: Update to version 5.7.12, or a newer patched version --- IDENTIFIER: CWE-502 (Deserialization of Untrusted Data) The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C