Vulnerabilities > CVE-2020-13700 - Authorization Bypass Through User-Controlled Key vulnerability in ACF to Rest API Project ACF to Rest API

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

acf-to-rest-api-project

CWE-639

NVD

Published: 2020-06-24

Updated: 2021-07-21

Summary

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.

Vulnerable Configurations

Part	Description	Count
Application	Acf_To_Rest_Api_Project ACF TO Rest API Project ACF TO Rest API 2.0.0 ACF TO Rest API Project ACF TO Rest API 2.0.1 ACF TO Rest API Project ACF TO Rest API 2.0.2 ACF TO Rest API Project ACF TO Rest API 2.0.3 ACF TO Rest API Project ACF TO Rest API 2.0.4 ACF TO Rest API Project ACF TO Rest API 2.0.5 ACF TO Rest API Project ACF TO Rest API 2.0.6 ACF TO Rest API Project ACF TO Rest API 2.0.7 ACF TO Rest API Project ACF TO Rest API 2.1.0 ACF TO Rest API Project ACF TO Rest API 2.1.1 ACF TO Rest API Project ACF TO Rest API 2.2.0 ACF TO Rest API Project ACF TO Rest API 2.2.1 ACF TO Rest API Project ACF TO Rest API 3.0.0 ACF TO Rest API Project ACF TO Rest API 3.0.1 ACF TO Rest API Project ACF TO Rest API 3.0.2 ACF TO Rest API Project ACF TO Rest API 3.1.0	17

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References