CVE-2023-1196

The Advanced Custom Fields plugin, in the 5.x and 6.x ranges before 5.12.5 and 6.1.0, unserializes user-controllable data, opening the door to PHP Object Injection. The two stated preconditions matter: the attacker needs at least a Contributor-level account, and a suitable gadget chain has to exist in the loaded code for the injection to escalate into something dangerous like code execution. Absent a gadget, the object injection is inert.

ACF is one of the most widely installed WordPress plugins, which is why this gets attention, but the exploitation reality is gated harder than the 8.8 suggests. It requires an authenticated contributor, not an anonymous request, and its severity depends on other plugins or themes supplying a usable gadget, so it is more a component of a chain than a standalone mass-exploit. Sites that hand out contributor accounts freely are the ones genuinely exposed.

We would rank this by the intersection of preconditions rather than the headline score: which of our WordPress sites run a vulnerable ACF version, allow untrusted contributor registrations, and carry a plausible gadget source. Given how hard plugins are to inventory per-site, our first task is enumerating ACF versions across the estate; the sites that also have open low-tier registration rise to the top, the rest can follow the normal patch cycle.