Vulnerability · Published Jan 24, 2022 · Assigned by WPScan
CVE-2021-24865Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
High 7.2
In plain English
A high-severity SQL injection in Advanced Custom Fields: Extended from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.5%top 25.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced Custom Fields: Extended | 0.8.8.7 – before 0.8.8.7 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/055a2dcf-77ec-4e54-be7d-9c47f7730d1b x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2648200 x_refsource_CONFIRM