GHSA-r345-x8hr-2r9p
acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | airesvsg/acf-to-rest-api | <= 3.1.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a `wp-json/acf/v3/options/` request that reads sensitive information in the `wp_options` table, such as the login and pass values.
References
External links from the advisory. They lead to third-party sites.