CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

• CWE-434
• CWE-434

• https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2Exploit, Third Party Advisory
• https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-filesThird Party Advisory
• https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2Exploit, Third Party Advisory
• https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-filesThird Party Advisory

Published

Aug 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25929The package smoothie from 1.31.0 and before 1.36.1 are vulne…5.4
• CVE-2022-2593The Better Search Replace WordPress plugin before 1.4.1 does…7.2
• CVE-2022-25931All versions of package easy-static-server are vulnerable to…7.5
• CVE-2022-25932The firmware of InHand Networks InRouter302 V3.5.45 introduc…9.8
• CVE-2022-25936Versions of the package servst before 2.0.3 are vulnerable t…7.5
• CVE-2022-25937Versions of the package glance before 3.0.9 are vulnerable t…6.5
• CVE-2022-25940All versions of package lite-server are vulnerable to Denial…7.5
• CVE-2022-25942An out-of-bounds read vulnerability exists in the gif2h5 fun…7.8
• CVE-2022-25943The installer of WPS Office for Windows versions prior to v1…7.8
• CVE-2022-25946On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, a…6.5
• CVE-2022-25948The package liquidjs before 10.0.0 are vulnerable to Informa…5.3
• CVE-2022-25949The kernel mode driver kwatch3 of KINGSOFT Internet Security…7.8