CVE-2023-3957 in ACF Photo Gallery Field Plugin
Summary
by MITRE • 07/27/2023
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/10/2026
The CVE-2023-3957 vulnerability affects the ACF Photo Gallery Field plugin for WordPress, representing a critical authorization flaw that enables authenticated attackers to manipulate user metadata. This vulnerability exists within the 'apg_profile_update' function, which fails to properly validate or restrict access to sensitive data modification capabilities. The flaw specifically impacts versions up to and including 1.9 of the plugin, creating a persistent security risk for WordPress installations that utilize this component. The vulnerability's impact is particularly concerning because it allows attackers with minimal privileges to escalate their access within the system, potentially leading to broader security compromises.
The technical nature of this vulnerability stems from inadequate input validation and access control mechanisms within the plugin's core functionality. Attackers with subscriber-level permissions or higher can exploit this flaw to modify arbitrary user metadata values, which can include sensitive information such as user roles, preferences, or other system-related attributes. The limitation that meta values can only be strings suggests that the vulnerability may be somewhat constrained in its immediate impact, but the ability to modify user metadata still provides attackers with significant opportunities to manipulate user access levels, bypass security controls, or establish persistent access points. This vulnerability directly relates to CWE-284, which describes inadequate access control mechanisms, and demonstrates how insufficient authorization checks can lead to privilege escalation and data manipulation.
The operational impact of this vulnerability extends beyond simple data modification, as it creates opportunities for attackers to undermine the integrity of user accounts and potentially compromise the broader WordPress installation. An attacker could use this vulnerability to elevate their privileges, modify user roles, or corrupt user metadata in ways that could affect system functionality or user experience. The fact that this affects authenticated users means that the vulnerability can be exploited through compromised accounts or by gaining access to low-privilege user accounts, making it particularly dangerous in environments where multiple users have access to the system. This vulnerability also aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through unauthorized access to system resources, as it allows attackers to manipulate user metadata to gain unauthorized access to additional resources.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest version of the ACF Photo Gallery Field plugin, which should contain proper access controls and input validation. Network monitoring should be enhanced to detect unauthorized metadata modifications, and access controls should be reviewed to ensure that only authorized users can modify user profiles. Additionally, implementing principle of least privilege access controls can help limit the damage potential of this vulnerability, while regular security audits should be conducted to identify and remediate similar authorization flaws in other plugins or system components. The vulnerability serves as a reminder of the importance of proper access control implementation and the need for thorough security testing of WordPress plugins before deployment in production environments.