WordPress plugin Vulnerability puts millions of websites at risk

Plugin Vulnerability in WordPress Advanced Custom Fields Plugin detected

Users of WordPress with the Advanced Custom Fields plugin installed should update their software, following the identification of a vulnerability in the code that exposes websites and visitors to cross-site scripting (XSS) attacks.

Patchstack issued an alert about the security flaw, stating that over two million active installs of both the Advanced Custom Fields and Advanced Custom Fields Pro plugins exist. These plugins offer site administrators enhanced control over content and data.

Patchstack researcher Rafie Muhammad discovered the vulnerability on February 5 and reported it to Delicious Brains, the vendor for Advanced Custom Fields.

On May 5 2023, Patchstack released information about the flaw, a month after Delicious Brains issued a patched version of the plugins. Users are advised to update their plugin to version 6.1.6 or later.

The vulnerability, identified as CVE-2023-30777 and assigned a CVSS severity score of 6.1 out of 10, makes websites susceptible to reflected XSS attacks. These attacks involve bad actors injecting malicious code into webpages, which is then “reflected” back and executed in a visitor’s browser.

In essence, this allows an attacker to execute JavaScript within another user’s view of a page, potentially stealing information, performing actions as the user, and more. This is particularly concerning if the visitor is a logged-in administrator, as their account could be compromised, leading to website takeover.

According to Patchstack’s report, “This vulnerability enables any unauthenticated user [to steal] sensitive information, leading to privilege escalation on the WordPress site by tricking the privileged user into visiting the crafted URL path.”

Patchstack further noted that “this vulnerability could be triggered on a default installation or configuration of the Advanced Custom Fields plugin. The XSS could also be triggered only by logged-in users with access to the Advanced Custom Fields plugin.”