ACF WordPress Plugin Security Update: Protecting Your Website

The widely-used Advanced Custom Fields (ACF) WordPress plugin, with over 2 million installations, has released a critical security update, version 6.2.5, aimed at addressing a potential security vulnerability. While the specifics of the vulnerability’s severity are not fully disclosed, it does require contributor-level access or higher for exploitation, making it challenging for potential attackers.

Key Points of Version 6.2.5

• This update alters how the ACF shortcode handles potentially unsafe HTML content by escaping it to enhance security.
• However, this change may impact websites using complex HTML elements like scripts or iframes, as certain tags (e.g., <script> and <iframe>) will be automatically removed.
• ACF’s decision to publicly announce this security update is unusual, as it deviates from the typical practice of quietly addressing vulnerabilities.
• A second security release, version 6.2.7, is planned for February 2024, providing users more time to prepare for potential changes affecting their websites.
• This update addresses a vulnerability that allowed contributors to insert malicious code, bypassing ACF’s usual security measures.

Developers are advised to be cautious when handling HTML output, using appropriate functions like echo get_field() for unfiltered HTML output and wp_kses_post for secure HTML sanitization.

See first source: Search Engine Journal

FAQ

1. What is the purpose of the ACF security update mentioned in the article?

The ACF security update, version 6.2.5, aims to address a potential security vulnerability in the plugin.

2. Is the severity of the vulnerability disclosed in the article?

The article does not provide specific details about the severity of the vulnerability, but it does note that it requires contributor-level access or higher for exploitation.

3. What key change does version 6.2.5 introduce?

Version 6.2.5 modifies how the ACF shortcode handles potentially unsafe HTML content by implementing escaping to enhance security.

4. How might this change impact websites that use ACF shortcodes?

Websites utilizing ACF shortcodes for complex HTML elements like scripts or iframes may experience automatic removal of certain tags (e.g., <script> and <iframe>), potentially affecting their functionality.

5. Why is the ACF security update considered unusual, as mentioned in the article?

Typically, security vulnerabilities are addressed quietly. However, this update is unique because ACF publicly announced it due to the potential for changes that could affect website functionality.

6. Are there further security updates planned for ACF?

Yes, ACF has scheduled a second security release, version 6.2.7, for February 2024. This additional release will provide users with more time to prepare for potential changes affecting their websites.

7. What prompted this security update in the first place?

The need for this update arose from the discovery of a vulnerability that allowed contributors, who typically have restricted access, to insert malicious code into websites, bypassing ACF’s usual security measures.

8. What guidance is offered to developers in the article?

Developers are advised to exercise caution when handling HTML output. They should use appropriate functions like echo get_field() for unfiltered HTML output and wp_kses_post for secure HTML sanitization.

Featured Image Credit: Photo by Stephen Phillips – Hostreviews.co.uk; Unsplash – Thank you!