Cyber Resilience

CVE-2024-4565

MediumPublic PoC

Published: 20 June 2024

Published
20 June 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0019 40.7th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-4565 is a medium-severity an unspecified weakness vulnerability in Advancedcustomfields Advanced Custom Fields. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked at the 40.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
Why these techniques?

The IDOR vulnerability in the Advanced Custom Fields WordPress plugin enables authenticated low-privileged users (Contributor+) to disclose arbitrary custom field values from any post (including private, draft, trashed) or options pages via shortcodes without access controls, facilitating collection of data from information repositories such as WordPress CMS.

Affected Assets

advancedcustomfields
advanced custom fields
≤ 6.3 · ≤ 6.3

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References