Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection

Vulnerability

The Advanced Custom Fields: Extended WordPress plugin before version 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL injection vulnerability [1]. The vulnerable code path is reachable when the plugin processes these parameters without proper sanitization.

Exploitation

An attacker needs no authentication or special privileges; the vulnerability can be exploited by sending a crafted HTTP request with malicious input in the order or orderby parameters. The attacker only needs to be able to reach the WordPress site running the vulnerable plugin version.

Impact

Successful exploitation allows an attacker to inject arbitrary SQL queries. This can lead to unauthorized access, modification, or deletion of database contents, potentially compromising the entire WordPress installation and exposing sensitive data.

Mitigation

The vulnerability is fixed in version 0.8.8.7 of the Advanced Custom Fields: Extended plugin [1]. Users should update to this version or later immediately. No workarounds are provided in the available references.