Threats tagged 'ghsa-v5v5-hmcv-q4fc'

The Advanced Custom Fields: Extended PRO plugin for WordPress up to version 0.9.2.6 is vulnerable to a limited code injection vulnerability via the render_field function. This flaw arises from insufficient validation of form configuration parameters, allowing unauthenticated attackers to invoke arbitrary WordPress functions with controlled arguments. Exploitation requires either enabling the non-default 'shortcode_preview' setting or a server environment lacking OpenSSL functions, which causes fallback to unverified base64 decoding.