Now officially on WordPress.org

CVE Database / CVE-2022-2594

CVE · High

CVE-2022-2594 — Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.3

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-2594 Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.3 Unrestricted Upload of File with Dangerous Type High 8.8 < 5.12.3 5.12.3 2022-07-14 —

CVE-2022-2594

The Advanced Custom Fields plugin before version 5.12.3 contains a vulnerability that permits unauthenticated visitors to upload files through frontend forms without proper access restrictions. While WordPress blocks PHP file uploads by default, attackers can still upload other dangerous file types that could be leveraged in secondary attacks to achieve code execution or conduct phishing campaigns. This flaw was introduced in the 5.0 release and was not present in earlier versions.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings