CVE-2021-20867 — Missing Authorization in Advanced Custom Fields

CWE-862 — Missing Authorization3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.7%
top 26.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Advancedcustomfields Advanced Custom FieldsDelicious Brains Advanced Custom Fields AND Advanced Custom Fields PRO
Timeline
PublishedDec 13
Latest updateDec 14

Description

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-cv28-8pqv-x45p: Advanced Custom Fields versions prior to 5↗2021-12-14
▶
CVEList
CVE-2021-20867: Advanced Custom Fields versions prior to 5↗2021-12-13
▶
CVE-2021-20867 — Missing Authorization | cvebase