vulnerability

WordPress Plugin: advanced-custom-fields: CVE-2021-20867: Missing Authorization

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
4	(AV:N/AC:L/Au:S/C:N/I:P/A:N)	Dec 2, 2021	May 15, 2025	Apr 30, 2026

Severity

CVSS

(AV:N/AC:L/Au:S/C:N/I:P/A:N)

Published

Dec 2, 2021

Added

May 15, 2025

Modified

Apr 30, 2026

Description

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.

Solution

advanced-custom-fields-plugin-cve-2021-20867

References

https://www.cve.org/CVERecord?id=CVE-2021-20867
https://www.wordfence.com/threat-intel/vulnerabilities/id/878246f7-17c5-4ea0-a450-27244ace2717?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-8276
CVE-2021-20867
https://attackerkb.com/topics/CVE-2021-20867
CWE-862
EUVD-EUVD-2021-8276

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report