CVE-2023-30777 – Unauthenticated reflected cross-site scripting ... (How to Fix)

Q: How do I fix CVE-2023-30777?

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Advanced Custom Fields or Advanced Custom Fields Pro. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress repository or ACF website and manually update.

Q: What is the severity of CVE-2023-30777?

CVE-2023-30777 has a CVSS score of 7.1 (HIGH). Unauthenticated reflected cross-site scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro and Advanced Custom Fields plugins allows attackers to inject malicious scripts via crafted URLs. This affects WordPress sites using these plugins in versions up to 6.1.5, potentially impacting approximately 2 million websites.

📋 TL;DR

Unauthenticated reflected cross-site scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro and Advanced Custom Fields plugins allows attackers to inject malicious scripts via crafted URLs. This affects WordPress sites using these plugins in versions up to 6.1.5, potentially impacting approximately 2 million websites.

💻 Affected Systems

Products:

WP Engine Advanced Custom Fields Pro
WP Engine Advanced Custom Fields

Versions: <= 6.1.5

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Affects both free and pro versions of the plugin. Requires WordPress installation with vulnerable plugin versions.

📦 What is this software?

Advanced Custom Fields by Advancedcustomfields

View all CVEs affecting Advanced Custom Fields →

Advanced Custom Fields by Advancedcustomfields

View all CVEs affecting Advanced Custom Fields →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites, potentially leading to complete site compromise.

🟠

Likely Case

Attackers craft malicious links containing JavaScript payloads that execute when victims click them, potentially stealing session cookies or performing limited unauthorized actions.

🟢

If Mitigated

With proper input validation and output encoding, malicious scripts would be neutralized before execution, preventing successful exploitation.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Reflected XSS vulnerabilities are commonly exploited via crafted URLs. Public details available in Patchstack advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.1.6 and later

Vendor Advisory: https://www.advancedcustomfields.com/blog/acf-6-1-6-security-release/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Advanced Custom Fields or Advanced Custom Fields Pro. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress repository or ACF website and manually update.

🔧 Temporary Workarounds

Input Validation Filter

all

Add custom input validation to sanitize user input before processing

Add custom WordPress filter: add_filter('acf/validate_value', 'custom_sanitize_function', 10, 4);

WAF Rule

all

Implement web application firewall rules to block XSS payloads in URLs

ModSecurity rule: SecRule ARGS "@rx <script>" "id:1001,phase:2,deny,status:403,msg:'XSS Attempt'"
Cloudflare WAF: Enable XSS protection rules

🧯 If You Can't Patch

Implement Content Security Policy (CSP) headers to restrict script execution sources
Use web application firewall to filter malicious input patterns

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 6.1.5 or earlier, you are vulnerable.

Check Version:

wp plugin list --name='advanced-custom-fields' --field=version (WP-CLI) or check WordPress admin plugins page

Verify Fix Applied:

After updating, verify plugin version shows 6.1.6 or later. Test with safe XSS payload in URL parameters to confirm sanitization.

📡 Detection & Monitoring

Log Indicators:

Unusual long URL parameters containing script tags or JavaScript code
Multiple 403 errors from WAF blocking XSS attempts
Referrer URLs containing suspicious script payloads

Network Indicators:

HTTP requests with script tags in query parameters
URLs containing encoded JavaScript payloads
Unusual spike in requests to ACF-related endpoints

SIEM Query:

source="web_logs" AND (uri="*<script>*" OR uri="*javascript:*" OR uri="*onload=*" OR uri="*onerror=*")

📊 Metadata

CVE ID: CVE-2023-30777

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE: CWE-79

Published: May 10, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-30777, you might also want to check these: