7.5High

CVE-2024-4565Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

Advanced Custom Fields (ACF); Advanced Custom Fields Pro; wpengine advanced_custom_field_pro; wpengine advanced_custom_fields Published: 2024-06-20 09:00 (2 years ago)

Description

The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access

Weakness (CWE): CWE-639

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
—	Advanced Custom Fields (ACF)	< 6.3
—	Advanced Custom Fields Pro	< 6.3
wpengine	advanced_custom_field_pro	< 6.3
wpengine	advanced_custom_fields	< 6.3

References and patches

https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/ exploitvdb-entrytechnical-description

CVSS score

7.5High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS (chance of exploitation in 30 days)

0.48%

higher than 42% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: yes
Technical impact: partial

Timeline

ID reserved2024-05-06
Published2024-06-20 09:00
Reached IP-DB2026-10-24 23:57
Last updated2025-08-27 15:00

Assigned by (CNA): WPScan

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

7.3High

CVE-2026-120834 7 hours ago

WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerability

Tobias WP2LEADS

Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17.

8.5High

CVE-2026-121769 7 hours ago

WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability

axew3.com WP w3all phpBB

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.

6.5Medium

CVE-2026-121573 7 hours ago

WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Melapress WP Activity Log

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.

7.1High

CVE-2026-123482 8 hours ago

WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Crocoblock JetFormBuilder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

7.1High

CVE-2026-122664 8 hours ago

WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability

VideoWhisper.com Broadcast Live Video

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through …

4.3Medium

CVE-2026-121612 8 hours ago

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability

WPZOOM WPBruiser {no- Captcha anti-Spam}

Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.