CVE-2023-3957

MEDIUM 4.3CVE-2023-3957 · Published 27/07/2023 · updated 17/06/2026

In short

CVE-2023-3957 is a MEDIUM (CVSS 4.3) vulnerability affecting acf photo gallery field (navz).
Chance of exploitation in the next 30 days (EPSS): 0.50%, higher than 43.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
acf photo gallery field navz	`≤ 1.9`	No fix yet

Description

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.

References

plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/1.9/includes/acf_photo_gallery_save.php · Patch
plugins.trac.wordpress.org/changeset/2943404/navz-photo-gallery · Patch
wordfence.com/threat-intel/vulnerabilities/id/689511e0-1355-4fcb-8a72-d819abc8e9a3 · Third Party Advisory

More vulnerabilities in acf photo gallery field

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free