UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2022-23183

Advanced Custom Field Pro: Missing Authorization

Severity
Medium 6.5
Published
30 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.12.1
Also known as
WPV-4086d0d723e1, WPV-6501abb6cfc4
Sources
NVD, WPVulnerability

Description

Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.

Affected software

SoftwareAffected versions
Advanced Custom FieldsServers and applications · cpe:a:advancedcustomfields:advanced_custom_fields
  • Every version before 5.12.1
Advanced Custom FieldsWordPress plugins · wp-plugin:advanced-custom-fields
  • Every version before 5.12.1
Advanced Custom Fields Pro (WordPress plugin)WordPress plugins · wp-plugin:advanced-custom-fields-pro
  • Every version before 5.12.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-23183
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-23183
  • Patchstack https://patchstack.com/database/wordpress/plugin/advanced-custom-fields/vulnerability/wordpress-advanced-custom-fields-plugin-5-12-database-information-access-vulnerability