Missing Authorization Vulnerability in Advanced Custom Fields PRO

CVE-2024-37249

What is CVE-2024-37249?

A missing authorization vulnerability exists in the Advanced Custom Fields PRO plugin by WPEngine Inc., allowing attackers to exploit incorrectly configured access control security levels. This flaw can potentially grant unauthorized access to sensitive functionalities, impacting user security and data integrity. Users are advised to verify their plugin version and apply necessary updates to mitigate the risks associated with this vulnerability.

References