[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fShnavYlhNsgA99wbaBX5_ucpS84HWa1f2qsKi94wgy4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-57378","advanced-forms-for-acf-missing-authorization","Advanced Forms for ACF \u003C= 1.9.3.7 - Missing Authorization","The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.9.3.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.","advanced-forms",null,"\u003C=1.9.3.7","1.9.3.8","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-07 00:00:00","2026-07-14 19:34:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F9cb25cc5-b8d3-4dbc-b0d3-2a824e34db4f?source=api-prod",8,[22,23,24,25,26],"admin\u002Fforms\u002Fforms-import.php","advanced-forms.php","api\u002Fapi-forms.php","core\u002Fforms\u002Fforms-rendering.php","readme.txt","researched",false,3,"I cannot fulfill your request to create a detailed exploitation plan for this vulnerability. My safety guidelines prohibit the generation of actionable instructions, payloads, or specific strategies for exploiting software vulnerabilities.\n\nInstead, I can provide a conceptual overview of the security principles involved and how developers can prevent similar issues.\n\n### Security Principles: Authorization and Integrity in WordPress\n\nThe vulnerability described (CVE-2026-57378) centers on **Missing Authorization** and **Missing CSRF Protection** (Nonces) in a function hooked to a global initialization action.\n\n#### 1. The Risk of `admin_init`\nIn WordPress, the `admin_init` hook runs whenever an administrative page is accessed. This includes common entry points used for processing data like `admin-ajax.php` and `admin-post.php`. Crucially, `admin_init` executes even before WordPress performs its own internal capability checks for specific pages.\n\nIf a plugin hooks a data-processing function (like an importer) to `admin_init` without implementing its own security checks, any user (and in some configurations, even unauthenticated visitors) can trigger that function by sending a request to an administrative endpoint.\n\n#### 2. Capability Checks (Authorization)\nTo ensure that only authorized users can perform sensitive actions (like importing configurations that could overwrite site data), developers must use `current_user_can()`. For administrative tasks, a capability like `manage_options` or a custom capability specific to the plugin is typically used.\n\n**Secure Pattern:**\n```php\nfunction my_sensitive_action() {\n    if ( ! current_user_can( 'manage_options' ) ) {\n        wp_die( __( 'You do not have sufficient permissions to access this page.' ) );\n    }\n    \u002F\u002F Proceed with action...\n}\n```\n\n#### 3. Nonce Verification (CSRF Protection)\nA \"Nonce\" (Number used ONCE) in WordPress is a unique token used to protect against Cross-Site Request Forgery (CSRF). It ensures that the request was intentionally sent by the user from a legitimate form within the WordPress dashboard, rather than forged by a third-party site.\n\n**Secure Pattern:**\n```php\n\u002F\u002F In the form:\nwp_nonce_field( 'my_action_string', 'my_nonce_name' );\n\n\u002F\u002F In the processing function:\nif ( ! isset( $_POST['my_nonce_name'] ) || ! wp_verify_nonce( $_POST['my_nonce_name'], 'my_action_string' ) ) {\n    wp_die( 'Security check failed' );\n}\n```\n\n### Remediation for CVE-2026-57378\nThe patch for this vulnerability (version 1.9.3.8) likely involves adding a capability check (e.g., checking for `edit_pages` or `manage_options`) and a nonce verification inside the `import_json_file()` function to ensure that only authorized administrators can upload and process JSON form files.\n\nFor further information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top Ten project](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F).","The Advanced Forms for ACF plugin is vulnerable to unauthorized data modification due to a missing capability check and nonce verification on its form import functionality. An unauthenticated attacker can overwrite existing forms or inject stored cross-site scripting (XSS) payloads by sending a crafted multipart POST request to administrative endpoints like admin-post.php.","\u002F\u002F admin\u002Fforms\u002Fforms-import.php\n\nclass AF_Admin_Forms_Import {\n  function __construct() {\n    add_action( 'admin_menu', array( $this, 'register_admin_page' ), 5, 0 );\n    add_action( 'admin_init', array( $this, 'import_json_file' ), 10, 0 );\n    add_filter( 'admin_title', array( $this, 'fix_admin_title' ), 10, 2 );\n  }\n\n\u002F\u002F ... lines 67-85 ...\n\n  function import_json_file() {\n    if ( ! isset( $_POST['af_import_json'] ) ) {\n      return;\n    }\n\n    if ( empty( $_FILES['af_import_json_file']['size'] ) ) {\n      return acf_add_admin_notice( __( 'No files selected', 'advanced-forms' ) );\n    }\n\n    $file = $_FILES['af_import_json_file'];\n    $json = file_get_contents( $file['tmp_name'] );\n    $json = json_decode( $json, true );\n\n    $post = af_import_form( $json );\n    if ( $post ) {\n\u002F\u002F ...","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fadvanced-forms\u002F1.9.3.7\u002Fadmin\u002Fforms\u002Fforms-import.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fadvanced-forms\u002F1.9.3.8\u002Fadmin\u002Fforms\u002Fforms-import.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fadvanced-forms\u002F1.9.3.7\u002Fadmin\u002Fforms\u002Fforms-import.php\t2022-12-07 06:40:04.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fadvanced-forms\u002F1.9.3.8\u002Fadmin\u002Fforms\u002Fforms-import.php\t2026-05-11 10:18:48.000000000 +0000\n@@ -36,6 +36,7 @@\n           \u003Ch2 class=\"hndle\">\u003Cspan>Import JSON file\u003C\u002Fspan>\u003C\u002Fh2>\n           \u003Cdiv class=\"inside\">\n             \u003Cform method=\"post\" enctype=\"multipart\u002Fform-data\">\n+              \u003C?php wp_nonce_field( 'af_import_form', 'af_import_nonce' ); ?>\n               \u003Cp>\n                 \u003C?php _e( 'Select the form JSON file you would like to import. If a form with the same key already exists it will be overwritten.', 'advanced-forms' ); ?>\n               \u003C\u002Fp>\n@@ -67,6 +68,26 @@\n       return;\n     }\n \n+    \u002F\u002F Only users who can manage forms may import. This also guards against\n+    \u002F\u002F unauthenticated requests, since admin_init fires on admin-post.php.\n+    if ( ! current_user_can( 'edit_pages' ) ) {\n+      wp_die(\n+        __( 'You do not have sufficient permissions to import forms.', 'advanced-forms' ),\n+        __( 'Error: Insufficient permissions', 'advanced-forms' ),\n+        array( 'back_link' => true )\n+      );\n+    }\n+\n+    \u002F\u002F Verify the nonce rendered on the import page.\n+    $nonce = isset( $_POST['af_import_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['af_import_nonce'] ) ) : '';\n+    if ( ! wp_verify_nonce( $nonce, 'af_import_form' ) ) {\n+      wp_die(\n+        __( 'Form could not be imported due to a missing or invalid nonce.', 'advanced-forms' ),\n+        __( 'Error: Invalid nonce', 'advanced-forms' ),\n+        array( 'back_link' => true )\n+      );\n+    }\n+\n     if ( empty( $_FILES['af_import_json_file']['size'] ) ) {\n       return acf_add_admin_notice( __( 'No files selected', 'advanced-forms' ) );\n     }\n@@ -75,6 +96,11 @@\n     $json = file_get_contents( $file['tmp_name'] );\n     $json = json_decode( $json, true );\n \n+    \u002F\u002F Bail if the uploaded file isn't a JSON object describing a form.\n+    if ( ! is_array( $json ) || empty( $json['key'] ) ) {\n+      return acf_add_admin_notice( __( 'The selected file is not a valid form export.', 'advanced-forms' ) );\n+    }\n+\n     $post = af_import_form( $json );\n     if ( $post ) {\n \t  \u002F* translators: The ACF field key *\u002F","The exploit takes advantage of the `admin_init` hook, which runs before capability checks on administrative entry points like `\u002Fwp-admin\u002Fadmin-post.php`. \n\n1. The attacker prepares a malicious JSON file containing a valid form structure (including a 'key' property). To achieve Stored XSS, the attacker includes malicious JavaScript in the 'display' -> 'description' field of the JSON.\n2. The attacker sends a multipart\u002Fform-data POST request to `http:\u002F\u002Fvictim-site.com\u002Fwp-admin\u002Fadmin-post.php` (or any admin URL).\n3. The request must include the POST parameter `af_import_json` to trigger the vulnerable function.\n4. The malicious JSON file is uploaded in the `af_import_json_file` parameter.\n5. Because the vulnerable version lacks `current_user_can` and `wp_verify_nonce` checks within `import_json_file`, the plugin processes the upload. \n6. The `af_import_form()` function (called on the uploaded data) will overwrite any existing form matching the provided 'key', effectively allowing an unauthenticated user to modify site configurations and execute XSS payloads whenever the form is viewed in the admin dashboard or on the frontend (prior to 1.9.3.8's sanitization fix).","gemini-3-flash-preview","2026-07-25 09:10:51","2026-07-25 09:11:40",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","1.9.3.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fadvanced-forms\u002Ftags\u002F1.9.3.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fadvanced-forms.1.9.3.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fadvanced-forms\u002Ftags\u002F1.9.3.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fadvanced-forms.1.9.3.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fadvanced-forms\u002Ftags"]