Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-1196— Advanced Custom Fields - Contributor+ PHP Object Injection

EPSS 0.88% · P76
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-1196

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Advanced Custom Fields - Contributor+ PHP Object Injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Advanced Custom Fields (ACF) Free and Pro 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Advanced Custom Fields (ACF) Free and Pro 存在代码问题漏洞，该漏洞源于反序列化用户可控数据时可能允许具有贡献者及以上角色的用户在存在合适的小工具时执行 PHP 对象注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
UnknownAdvanced Custom Fields (ACF) 5.0.0 ~ 5.12.5 -
UnknownAdvanced Custom Fields (ACF) Pro 5.0.0 ~ 5.12.5 -

II. Public POCs for CVE-2023-1196

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-1196

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2023-05-02 · 17 CVEs total

CVE-2023-1730SupportCandy < 3.1.5 - Unauthenticated SQLi
CVE-2023-1546MyCryptoCheckout < 2.124 - Reflected XSS
CVE-2023-1911Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
CVE-2023-1090WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS
CVE-2023-1614WP Custom Author URL < 1.0.5 - Admin+ Stored XSS
CVE-2023-1804Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
CVE-2023-0891Stagtools < 2.3.7 - Contributor+ Stored XSS
CVE-2023-1669SEOPress < 6.5.0.3 - Admin+ PHP Object Injection
CVE-2023-1809Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure
CVE-2023-1805Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
CVE-2023-1125Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR
CVE-2023-1021Amr Ical Events Lists <= 6.6 - Admin+ Stored XSS
CVE-2023-1554Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS
CVE-2023-1861Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS
CVE-2023-1525Site Reviews < 6.7.1 - Admin+ Stored XSS
CVE-2023-0924Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload

IV. Related Vulnerabilities

Same product: Advanced Custom Fields (ACF)
Same vendor: Unknown

V. Comments for CVE-2023-1196

No comments yet

Leave a comment