CVE-2024-4565: ACF WordPress Auth Bypass Vulnerability

CVE-2024-4565 Overview

CVE-2024-4565 affects the Advanced Custom Fields (ACF) and Advanced Custom Fields Pro plugins for WordPress. Versions before 6.3 fail to verify access controls when displaying custom field values through shortcodes. Authenticated users with low privileges can retrieve custom field values from any post, including drafts, private posts, and password-protected content. The vulnerability stems from missing authorization checks in the shortcode handler responsible for rendering field data.

Critical Impact

Authenticated attackers can disclose custom field values from restricted posts, exposing sensitive editorial content, private metadata, and unpublished material across WordPress sites running vulnerable ACF versions.

Affected Products

• Advanced Custom Fields (ACF) WordPress plugin before 6.3
• Advanced Custom Fields Pro WordPress plugin before 6.3
• WordPress installations using ACF shortcodes for field rendering

Discovery Timeline

• 2024-06-20 - CVE-2024-4565 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-4565

Vulnerability Analysis

The vulnerability resides in the ACF shortcode processor that renders custom field values for posts. The plugin accepts a post_id parameter through shortcode arguments without validating whether the requesting user has permission to view the target post. Any authenticated user, including those with subscriber-level roles, can supply arbitrary post identifiers and receive the associated field values.

The flaw is classified as a broken access control issue. The attack vector is network-based and requires low privileges with no user interaction. The integrity impact is high because data exposure may include unpublished editorial decisions, private business metadata, and operational secrets stored in custom fields.

Root Cause

The root cause is missing capability checks within the shortcode rendering logic. The plugin trusts the supplied post_id argument and queries field data directly. WordPress capability functions such as current_user_can('read_post', $post_id) are not invoked before returning field values. This allows lookups against draft, private, trashed, and password-protected posts regardless of the requesting user's role.

Attack Vector

An attacker authenticates to the WordPress site with any account that can render shortcodes, including comment authors or subscribers on configurations that process shortcodes in profile fields or comments. The attacker then embeds an ACF shortcode referencing a restricted post identifier. The server processes the shortcode, retrieves the field data, and returns it in the rendered output. The attacker enumerates post IDs to extract custom field content from across the site. For technical specifics, see the WPScan Vulnerability Analysis.

Detection Methods for CVE-2024-4565

Indicators of Compromise

• Requests from low-privilege user accounts that submit content containing ACF shortcodes referencing post IDs the user does not own
• Web server logs showing repeated POST or comment submissions with [acf shortcode patterns and varying post_id parameters
• Unexpected access patterns from subscriber-level accounts enumerating sequential post identifiers

Detection Strategies

• Audit WordPress content tables for stored shortcodes referencing acf, acf_field, or acf-value patterns submitted by non-editor accounts
• Inspect plugin version metadata across managed WordPress instances to identify ACF or ACF Pro installations below 6.3
• Correlate authentication logs with rendered page outputs to identify access to private post metadata by accounts lacking read permissions

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture shortcode rendering events and the resolving user context
• Monitor outbound responses for field values from posts in draft, private, or pending status served to non-privileged users
• Track installed plugin versions through centralized configuration management and alert on installations of ACF below 6.3

How to Mitigate CVE-2024-4565

Immediate Actions Required

• Upgrade Advanced Custom Fields and Advanced Custom Fields Pro to version 6.3 or later on all WordPress installations
• Review user roles and remove unnecessary shortcode rendering capabilities from subscriber and contributor accounts
• Audit existing posts and comments for embedded ACF shortcodes that reference posts other than the author's own content

Patch Information

The vendor released version 6.3 of both Advanced Custom Fields and Advanced Custom Fields Pro to address this issue. The patched releases add capability checks to verify the requesting user can read the target post before returning field values. Site administrators should apply the update through the WordPress plugin manager or by downloading the latest release directly from the vendor. Refer to the WPScan Vulnerability Analysis for additional remediation guidance.

Workarounds

• Restrict shortcode processing in user-generated content areas such as comments and profile fields using filters like do_shortcode removal
• Apply a web application firewall rule that blocks ACF shortcode patterns submitted by accounts below the editor role
• Limit account self-registration and require manual approval for new WordPress accounts until the patch is applied

# Update ACF via WP-CLI
wp plugin update advanced-custom-fields --version=6.3
wp plugin update advanced-custom-fields-pro --version=6.3

# Verify installed version
wp plugin get advanced-custom-fields --field=version