CVE-2023-30777: Advanced Custom Fields XSS Vulnerability

CVE-2023-30777 Overview

CVE-2023-30777 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability affecting WP Engine's Advanced Custom Fields and Advanced Custom Fields Pro plugins for WordPress. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users without requiring authentication, potentially impacting over 2 million WordPress sites that utilize these popular plugins.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in the context of an authenticated administrator's browser session, potentially leading to session hijacking, credential theft, or administrative account takeover on affected WordPress installations.

Affected Products

• WP Engine Advanced Custom Fields plugin versions <= 6.1.5
• WP Engine Advanced Custom Fields Pro plugin versions <= 6.1.5
• WordPress sites running vulnerable versions of either plugin

Discovery Timeline

• 2023-05-10 - CVE-2023-30777 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-30777

Vulnerability Analysis

This vulnerability is classified as a Reflected Cross-Site Scripting (XSS) flaw (CWE-79). The root issue lies in improper neutralization of user input during web page generation within the Advanced Custom Fields plugin. When user-supplied data is reflected back in HTTP responses without proper encoding or sanitization, attackers can craft malicious URLs that execute arbitrary JavaScript code in the victim's browser context.

The attack requires user interaction—specifically, an authenticated WordPress administrator must click on a maliciously crafted link. Once clicked, the injected script executes with the victim's privileges, enabling actions such as stealing session cookies, performing unauthorized administrative operations, or redirecting users to phishing sites.

The vulnerability has demonstrated significant real-world exploitation potential, as indicated by its high EPSS probability score of 85.78% (99th percentile), suggesting this vulnerability is among the most likely to be exploited in the wild.

Root Cause

The vulnerability stems from insufficient input validation and output encoding within the Advanced Custom Fields plugin. User-controllable input is directly reflected in the HTML response without proper sanitization, allowing HTML and JavaScript injection. This represents a failure to implement proper context-aware output encoding, which is essential for preventing XSS attacks in web applications.

Attack Vector

The attack is executed over the network and requires social engineering to trick an authenticated user into clicking a malicious link. The attacker constructs a specially crafted URL containing JavaScript payload and delivers it to the target through phishing emails, social media, or other channels.

The vulnerability affects the changed scope (S:C in the CVSS vector), meaning the vulnerable component and the impacted component are different—the plugin is vulnerable, but the user's browser and session are impacted. This allows the attacker to potentially compromise not just the WordPress plugin but the entire WordPress administrative session.

A typical attack scenario involves an attacker crafting a URL with an XSS payload embedded in a vulnerable parameter. When an administrator clicks the link while logged into their WordPress dashboard, the malicious script executes in their browser session. The script could then exfiltrate session cookies, create rogue administrator accounts, or modify site content. For detailed technical analysis, see the Patchstack security article.

Detection Methods for CVE-2023-30777

Indicators of Compromise

• Unusual URL parameters containing JavaScript code or HTML entities in requests to WordPress admin pages
• Unexpected outbound connections from administrator browser sessions to unknown domains
• Suspicious admin account creations or privilege changes that correlate with administrator access times
• Web server logs showing encoded script tags or event handlers in query strings

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters
• Monitor WordPress access logs for requests containing suspicious patterns such as <script>, javascript:, or encoded variants
• Deploy browser-based Content Security Policy (CSP) headers to restrict inline script execution
• Enable WordPress audit logging to track administrative actions and identify unauthorized changes

Monitoring Recommendations

• Configure real-time alerting for requests matching known XSS payload patterns targeting the Advanced Custom Fields plugin endpoints
• Implement user session monitoring to detect anomalous behavior following external link clicks
• Review WordPress user activity logs regularly for unexpected administrative actions
• Monitor for new user account creations or permission changes that may indicate post-exploitation activity

How to Mitigate CVE-2023-30777

Immediate Actions Required

• Update Advanced Custom Fields and Advanced Custom Fields Pro plugins to version 6.1.6 or later immediately
• Audit WordPress administrator accounts for any unauthorized changes or new accounts
• Review site content and configurations for signs of tampering
• Educate administrators about the risks of clicking unknown links while logged into WordPress

Patch Information

The vulnerability has been addressed by WP Engine in Advanced Custom Fields version 6.1.6 and later releases. Organizations should update to the latest available version to ensure all security fixes are applied. The patch implements proper input sanitization and output encoding to prevent the reflection of malicious scripts.

For additional patch details, refer to the Patchstack vulnerability database entry for ACF and the ACF Pro vulnerability entry.

Workarounds

• Implement strict Content Security Policy (CSP) headers to mitigate XSS impact by restricting script sources
• Deploy a Web Application Firewall with XSS filtering rules enabled
• Limit WordPress administrative access to trusted IP addresses or VPN connections
• Use browser extensions or policies that warn administrators before navigating to external links

# Example: Add CSP header to WordPress via .htaccess
# Add to your .htaccess file in the WordPress root directory
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>