CVE-2024-4565: Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-20 · updated 2026-06-17

Description

The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access

Affected products

WP Engine Advanced Custom Fields: before 6.3 — fixed in 6.3

How to fix

Upgrade to a fixed version: WP Engine Advanced Custom Fields 6.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/
https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/

Get alerted when CVE-2024-4565 or the next vulnerability affects your stack