WordPress' Avanced Custom Fields plugin exposed to high-severity XSS vulnerability

Advanced Custom Fields (ACF) is a widely used plugin that allows WordPress users to create powerful custom fields for their websites. With over 2 million installations, it's no surprise that it has caught the attention of hackers.

Recently, a researcher from Patchstack, Rafie Muhammad, discovered a high-severity reflected XSS vulnerability (CVE-2023-30777) in the ACF plugin. This vulnerability could allow an unauthenticated user to steal sensitive information or even gain privilege escalation on the WordPress site by tricking privileged users into visiting a crafted URL path.

Thankfully, the ACF team quickly addressed the issue and released version 6.1.6 of the plugin. This version includes a fix for the vulnerability, ensuring that users can continue to use the plugin without worrying about security risks.

This incident serves as a reminder of the importance of keeping plugins and software up-to-date. Even popular plugins with millions of installations can be vulnerable to attacks, and it's crucial to stay vigilant and update software as soon as new versions are released.

WordPress users should also consider implementing additional security measures, such as using a web application firewall (WAF) or regularly scanning their site for vulnerabilities. By taking these steps, website owners can help prevent security breaches and keep their sites safe from harm.