What’s Vulnerable › Vulnerabilities

CVE-2022-2594: Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-22 · updated 2026-06-17
• Weakness: CWE-434

Description

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

Affected products

• WP Engine Advanced Custom Fields: from 5.0.0 before 5.12.3 — fixed in 5.12.3

How to fix

Upgrade to a fixed version: WP Engine Advanced Custom Fields 5.12.3. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2
• https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-files
• https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2
• https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-files

Get alerted when CVE-2022-2594 or the next vulnerability affects your stack