Post Type and Taxonomy metabox callbacks no longer have access to any superglobal values such as $_POST, $_REQUEST.
Due to insufficient input validation via the ‘register_meta_box_cb’ and ‘meta_box_cb’ parameters parameters, makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary functions, like WordPress functions, in custom post types that will execute whenever a user accesses the injected post type. This can be leveraged to trick other users like administrators accessing posts into performing unauthorized actions through functions, and is not a very serious risk for the vast majority of site owners. Please follow the reference listed in this vulnerability record for instructions on how to update to the latest version of ACF that patches this issue and ensures accessibility to updates moving forward.
This vulnerability affects the following application versions:
- Advanced Custom Fields (ACF) 6.1.0
- Advanced Custom Fields (ACF) 6.1.1
- Advanced Custom Fields (ACF) 6.1.2
- Advanced Custom Fields (ACF) 6.1.3
- Advanced Custom Fields (ACF) 6.1.4
- Advanced Custom Fields (ACF) 6.1.5
- Advanced Custom Fields (ACF) 6.1.6
- Advanced Custom Fields (ACF) 6.1.7
- Advanced Custom Fields (ACF) 6.1.8
- Advanced Custom Fields (ACF) 6.2.0
- Advanced Custom Fields (ACF) 6.2.1
- Advanced Custom Fields (ACF) 6.2.2
- Advanced Custom Fields (ACF) 6.2.3
- Advanced Custom Fields (ACF) 6.2.4
- Advanced Custom Fields (ACF) 6.2.5
- Advanced Custom Fields (ACF) 6.2.6
- Advanced Custom Fields (ACF) 6.2.6.1
- Advanced Custom Fields (ACF) 6.2.7
- Advanced Custom Fields (ACF) 6.2.8
- Advanced Custom Fields (ACF) 6.2.9
- Advanced Custom Fields (ACF) 6.3.0
- Advanced Custom Fields (ACF) 6.3.1
- Advanced Custom Fields (ACF) 6.3.2
- Advanced Custom Fields (ACF) 6.3.3
- Advanced Custom Fields (ACF) 6.3.4
- Advanced Custom Fields (ACF) 6.3.5
- Advanced Custom Fields (ACF) 6.3.6
- Advanced Custom Fields (ACF) 6.3.6.1
- Advanced Custom Fields (ACF) 6.3.6.2