Advanced Custom Fields: Extended WordPress Plugin Unauthenticated Arbitrary Shortcode Execution Vulnerability

A vulnerability allowing unauthenticated arbitrary shortcode execution has been identified in the Advanced Custom Fields: Extended plugin for WordPress, affecting all versions through 0.9.2.3. The issue arises because the plugin allows users to execute actions without proper validation, enabling the execution of arbitrary shortcodes via the email action in forms.

Impact

Exploitation of this vulnerability allows for arbitrary shortcode execution, which could lead to various impacts depending on the executed shortcode.

Reproduction

To reproduce this vulnerability, create a form using the Advanced Custom Fields: Extended plugin version 0.9.2.3 or earlier. Include the email action in the form. Once the form is submitted, the vulnerability can be exploited by injecting a shortcode that is not properly validated before execution. This can be done by manipulating the form's success message or using a mapped field group.

Remediation

Users are advised to update the Advanced Custom Fields: Extended plugin to version 0.9.2.4 or a newer patched version.