CVE-2022-2594: advancedcustomfields advanced custom fields

csirt@kutim:~/threat-intel/cve/CVE-2022-2594

CVSS 8.8 · High EPSS 1,6%

Kerentanan Unrestricted Upload of File with Dangerous Type pada advancedcustomfields advanced custom fields. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

Rincian

Terbit di NVD: 22 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 1,6% peluang dieksploitasi; lebih tinggi dari 75,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
advancedcustomfields	advanced custom fields	Versi 5.0.0 hingga sebelum 5.12.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2 exploit · advisory pihak ketiga
https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary... advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.