CVE-2022-40696

HIGH 7.5CVE-2022-40696 · Published 08/01/2024 · updated 17/06/2026

In short

CVE-2022-40696 is a HIGH (CVSS 7.5) vulnerability affecting advanced custom fields (advancedcustomfields).
Chance of exploitation in the next 30 days (EPSS): 0.52%, higher than 43.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
advanced custom fields advancedcustomfields	`≥ 3.1.1, ≤ 6.0.2`	No fix yet

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.

References

patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-3-1-1-6-0-2-custom-field-value-exposure · Third Party Advisory

More vulnerabilities in advanced custom fields

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

advanced custom fields

advancedcustomfields

≥ 3.1.1, ≤ 6.0.2

No fix yet

More vulnerabilities in advanced custom fields

See all →