UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2022-2594

Advanced Custom Field Pro: Unrestricted Upload of File with Dangerous Type

Severity
High 8.8
Published
14 Jul 2022
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.12.3
Also known as
WPV-ab8f5a7ad5cb, WPV-ff98694286c6
Sources
NVD, WPVulnerability

Description

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

Affected software

SoftwareAffected versions
Advanced Custom FieldsServers and applications · cpe:a:advancedcustomfields:advanced_custom_fields
  • From 5.0.0 before 5.12.3
Advanced Custom FieldsWordPress plugins · wp-plugin:advanced-custom-fields
  • Every version before 5.12.3
Advanced Custom Fields Pro (WordPress plugin)WordPress plugins · wp-plugin:advanced-custom-fields-pro
  • Every version before 5.12.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-2594
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-2594
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-custom-fields/advanced-custom-fields-5122-file-upload