-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| airesvsg/acf-to-rest-api | composer | <= 3.1.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The options controller directly uses user-supplied 'id' parameter to access wp_options entries without authorization checks (CWE-639). 2) The field processing function allows combining URL parameters to construct arbitrary option names (like 'mailserver_pass') through $_GET['id'] and $_GET['field'] manipulation (CWE-200). The plugin's REST endpoints expose raw option access without implementing WordPress capability checks or proper object reference validation, enabling direct database table enumeration through parameter manipulation as demonstrated in the exploit examples.
Ongoing coverage of React2Shell