UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-1196

Advanced Custom Field Pro: Deserialization of Untrusted Data

Severity
High 8.8
Published
3 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.12.5, 6.1.0
Also known as
WPV-94ba7c5c4a3b, WPV-acc188e37353
Sources
NVD, WPVulnerability

Description

The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.

Affected software

SoftwareAffected versions
Advanced Custom FieldsServers and applications · cpe:a:advancedcustomfields:advanced_custom_fields
  • From 5.0.0 before 5.12.5
  • From 6.0.0 before 6.1.0
Advanced Custom FieldsWordPress plugins · wp-plugin:advanced-custom-fields
  • Every version before 5.12.5
Advanced Custom Fields Pro (WordPress plugin)WordPress plugins · wp-plugin:advanced-custom-fields-pro
  • Every version before 5.12.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-1196
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-1196