CVE-2023-3957
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized data modification due to insufficient restrictions on the 'apg_profile_update' function in versions up to and including 1.9. This allows authenticated attackers with subscriber-level permissions or above to arbitrarily update user metas.
Risk Assessment
Attackers can modify user metadata, which may lead to data integrity breaches and potential account takeover.
Recommendation
It is recommended to update the ACF Photo Gallery Field plugin to the latest version to mitigate this vulnerability. Additionally, restrict access to metadata update functions to trusted users only.
Original NVD description (English source)
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.