{"id":"CVE-2024-4565","state":"PUBLISHED","title":"Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access","description":"The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access","publishedAt":"2024-06-20T06:00:02.546Z","updatedAt":"2025-08-27T12:00:41.514Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Advanced Custom Fields (ACF)","Unknown Advanced Custom Fields Pro"],"affected":[{"vendor":"Unknown","product":"Advanced Custom Fields (ACF)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.3","versionType":"semver"}]},{"vendor":"Unknown","product":"Advanced Custom Fields Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.3","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4565.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4565","state":"PUBLISHED","datePublished":"2024-06-20T06:00:02.546Z","dateUpdated":"2025-08-27T12:00:41.514Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-05-06T19:04:45.951Z"},"containers":{"cna":{"title":"Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access","descriptions":[{"lang":"en","value":"The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access"}],"affected":[{"vendor":"Unknown","product":"Advanced Custom Fields (ACF)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.3","versionType":"semver"}]},{"vendor":"Unknown","product":"Advanced Custom Fields Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.3","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2025-08-27T12:00:41.514Z"},"credits":[{"lang":"en","value":"Scott Kingsley Clark","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"wpengine","product":"advanced_custom_field_pro","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"6.3","versionType":"custom"}],"cpes":["cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"]},{"vendor":"wpengine","product":"advanced_custom_fields","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"6.3","versionType":"custom"}],"cpes":["cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-20T13:40:36.821631Z","id":"CVE-2024-4565","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-20T13:42:56.802Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:47:40.536Z"}}]}}}