Threats tagged 'ghsa-6gvj-qmj9-cj2m'

The Advanced Custom Fields: Extended plugin for WordPress versions up to and including 0.9.2.7 contains a vulnerability that allows unauthenticated attackers to expose sensitive information. By injecting a {get_user} template tag into a publicly accessible form configured with specific shortcode and field mappings, attackers can retrieve sensitive data such as WordPress password hashes. This requires that an administrator has set up a public [acfe_form] shortcode page with a Term action using a save.name field mapping, which is a supported configuration.