CVE-2024-4565: Advanced Custom Fields Auth Bypass Flaw

CVE-2024-4565 Overview

CVE-2024-4565 is an access control vulnerability affecting the Advanced Custom Fields (ACF) WordPress plugin, one of the most popular plugins for extending WordPress content management capabilities. The vulnerability allows authenticated users to display custom field values for any post via shortcode without proper access verification, potentially exposing sensitive information stored in custom fields across the WordPress installation.

Critical Impact

Authenticated attackers can bypass access controls to read custom field data from any post, including private or restricted content, leading to potential information disclosure across the WordPress site.

Affected Products

• Advanced Custom Fields WordPress plugin before version 6.3
• Advanced Custom Fields Pro WordPress plugin before version 6.3

Discovery Timeline

• 2024-06-20 - CVE-2024-4565 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-4565

Vulnerability Analysis

This vulnerability represents a broken access control flaw in the ACF shortcode functionality. The plugin's shortcode handler fails to verify whether the requesting user has legitimate access to view the custom field data associated with a specific post. This architectural oversight means that any authenticated user, regardless of their role or permissions, can craft shortcodes to retrieve custom field values from posts they would not normally have access to view.

The impact is particularly significant for WordPress sites that store sensitive data in custom fields, such as user metadata, configuration values, internal notes, or other protected information. Sites using ACF to manage access-restricted content areas are especially vulnerable to this information disclosure vector.

Root Cause

The root cause stems from insufficient authorization checks in the shortcode rendering logic. When the ACF plugin processes a shortcode request to display custom field values, it retrieves the data based solely on the post ID and field name parameters without validating whether the current user has permission to access the referenced post's custom fields. This missing access control check allows any authenticated user to enumerate and extract custom field data from arbitrary posts.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the WordPress site. An attacker with any authenticated user role (including Subscriber) can exploit this vulnerability by:

1. Crafting ACF shortcodes with targeted post IDs and field names
2. Embedding these shortcodes in contexts where they will be rendered (comments, if allowed, or through other content submission mechanisms)
3. Retrieving the rendered output containing the exposed custom field values

The vulnerability requires no user interaction and can be exploited remotely through the WordPress interface. Attackers may enumerate post IDs and common field names to systematically extract data across the site.

Detection Methods for CVE-2024-4565

Indicators of Compromise

• Unusual shortcode usage patterns in user-submitted content referencing post IDs the user shouldn't access
• Spike in ACF shortcode rendering requests from low-privilege user accounts
• Access log entries showing authenticated users requesting content containing field data from restricted posts
• User content containing ACF shortcodes with explicit post ID parameters targeting other users' content

Detection Strategies

• Monitor WordPress activity logs for shortcode usage patterns, especially those referencing post IDs outside the user's authored content
• Implement web application firewall (WAF) rules to detect and flag suspicious ACF shortcode patterns
• Review user-generated content submissions for embedded ACF shortcodes
• Enable WordPress audit logging to track custom field access patterns

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor WordPress plugin directories for unauthorized modifications
• Set up alerts for bulk requests that may indicate systematic data enumeration attempts
• Monitor database query patterns for unusual custom field access across multiple posts
• Implement real-time alerting on new shortcode submissions containing field reference parameters

How to Mitigate CVE-2024-4565

Immediate Actions Required

• Update Advanced Custom Fields to version 6.3 or later immediately
• Update Advanced Custom Fields Pro to version 6.3 or later immediately
• Audit existing custom fields for sensitive data that may have been exposed
• Review user-submitted content for evidence of exploitation attempts
• Consider temporarily disabling ACF shortcode functionality if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Advanced Custom Fields version 6.3 and Advanced Custom Fields Pro version 6.3. The fix implements proper access control checks in the shortcode handler to verify that the requesting user has permission to access the referenced post's custom field data before rendering. Administrators should update through the WordPress plugin manager or download the patched version from the official ACF website. Additional technical details are available in the WPScan Vulnerability Report.

Workarounds

• Disable ACF shortcode functionality in user-submitted content areas until patching is complete
• Restrict user registration and limit authenticated access to trusted users only
• Implement content moderation to review user submissions for suspicious shortcode patterns
• Use WordPress security plugins to filter potentially malicious shortcode submissions

# Configuration example - Disable ACF shortcode for non-admin users in theme functions.php
# Add this to your WordPress theme's functions.php file
add_filter('acf/shortcode/allow_in_content', function($allow) {
    if (!current_user_can('manage_options')) {
        return false;
    }
    return $allow;
});