Users of the Advanced Custom Fields plugin for WordPress are urged to update to version 6.1.6 following the discovery of a security vulnerability.
The issue, assigned the identifier CVE-2023-30777, involves a case of reflected cross-site scripting (XSS) that can be abused to inject arbitrary executable scripts into otherwise benign websites.
The plugin, available in both free and professional editions, has more thantwo million active installations. The issue was found and reported to the maintainers in February 2023.
"This vulnerability allows any unauthenticated user to steal sensitive information — in this case, to escalate privileges on a WordPress site by tricking a privileged user into visiting a crafted URL," said Rafie Muhammad, a researcher at Patchstack.
AttacksXSSreflected typically occurs when a victim is tricked into clicking a bogus link delivered by email or another route, causing malicious code to be sent to the vulnerable website, which reflects the attack back into the user’s browser.
This social-engineering element means that reflected XSS does not have the same reach and scale as stored XSS attacks, which pushes threat actors to distribute malicious links to as many victims as possible.
“[A reflected XSS attack] is usually the result of incoming requests not being sufficiently sanitized, which allows a web application’s functions to be manipulated and malicious scripts to be triggered,” Imperva notes.
It should be noted that CVE-2023-30777 can be triggered on a default installation or configuration of Advanced Custom Fields, although only by a logged-in user who has access to the plugin.
This comes as Craft CMS patched two medium-severity XSS vulnerabilities (CVE-2023-30177 andCVE-2023-31144) could be exploited by threat actors to deliver a malicious payload.
It also follows the disclosure of another XSS vulnerability in the cPanel product (CVE-2023-29489, CVSS score: 6.1) can be exploited without any authentication to run arbitrary JavaScript.
“An attacker could target not only cPanel's management ports but also applications running on ports 80 and 443,” added Shubham Shah of Assetnote, noting that it could allow an adversary to hijack a legitimate user's cPanel session.
“Once an action can be performed on behalf of an authenticated cPanel user, uploading a web shell and executing commands is usually trivial.”
