airesvsg/acf-to-rest-api

airesvsg/acf-to-rest-api

GitHubGitHub
GitHubgithub.com
WordPress Pluginwordpress.org
Releases13
Frequency8 months 1 week
Last Release
Stars1.36K
Exposes Advanced Custom Fields Endpoints in the WordPress REST API
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2020-13700↗
7.5 HIGH5 MEDIUM

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.