CVE-2021-24865

ALTO 7.2CVE-2021-24865 · Published 24/01/2022 · updated 17/06/2026

In breve

CVE-2021-24865 è una vulnerabilità ALTO (CVSS 7.2) che riguarda advanced custom fields (acf-extended).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 74.4% delle vulnerabilità.
Correzione: aggiornare a 0.8.8.7 o successiva.

Package	Affected versions	Patched versions
advanced custom fields acf-extended	`< 0.8.8.7`	`0.8.8.7`

Description

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue

References

plugins.trac.wordpress.org/changeset/2648200 · Patch
wpscan.com/vulnerability/055a2dcf-77ec-4e54-be7d-9c47f7730d1b · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free