title: Advanced Custom Fields - Contributor+ PHP Object Injection
description: The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
vendor: Unknown
product: Advanced Custom Fields (ACF)
versions:
status: affected, versionType: custom, version: 5.0.0, lessThan: 5.12.5
status: affected, versionType: custom, version: 6.0.0, lessThan: 6.1.0
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}
{
vendor: Unknown
product: Advanced Custom Fields (ACF) Pro
versions:
status: affected, versionType: custom, version: 5.0.0, lessThan: 5.12.5
status: affected, versionType: custom, version: 6.0.0, lessThan: 6.1.0
defaultStatus: unaffected
}
