CVE-2021-24865

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue

Score

CVSS 3.1 7.2 High

Status

Modified - contact@wpscan.com

Published

2022-01-24

Last modified

2024-08-03

Weaknesses

CWE-89

Affected products

• Advanced Custom Fields\ (Acf-extended)
• Advanced Custom Fields Extended (Unknown)

References

• https://plugins.trac.wordpress.org/changeset/2648200
• https://wpscan.com/vulnerability/055a2dcf-77ec-4e54-be7d-9c47f7730d1b