Advanced Custom Fields: Extended WordPress plugin < 0.9.2.8 and Advanced Custom Fields: Extended PRO WordPress plugin < 0.9.2.8 contain a broken access control vulnerability caused by missing capability checks in front-end post update actions, letting unauthenticated visitors overwrite arbitrary posts and execute arbitrary code on the server, exploit requires a published form mapping post-update target and content to visitor inputs.
Update to version 0.9.2.8 or later.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.
