CVE-2023-30777 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: WP Engine. 📦 **Product**: WordPress Plugin Advanced Custom Fields PRO. 📅 **Affected**: Version 6.1.5 and earlier. ✅ **Fixed**: Version 6.1.6+.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: Yes, Public. 📂 **PoC**: Available on GitHub (Alucard0x1). 🔎 **Scanner**: Nuclei templates exist. 🌍 **Wild Exploitation**: High potential due to easy PoC generation and UI:R nature.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 🔄 **Patch**: Upgrade to Advanced Custom Fields PRO v6.1.6 or later. 📝 **Note**: Official vendor release addresses the sanitization issue. 📥 Action: Update immediately via WP dashboard.

Updated May 08, 2026 CVSS 7.1 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Reflected Cross-Site Scripting (XSS) in Advanced Custom Fields PRO. <br>💥 **Consequences**: Malicious scripts injected into pages. Steals cookies, hijacks sessions, or redirects users.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-79 (Improper Neutralization of Input During Web Page Generation). <br>🔍 **Flaw**: Insufficient input sanitization & output escaping. The `post_status` parameter is not properly handled.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: WP Engine. <br>📦 **Product**: WordPress Plugin Advanced Custom Fields PRO. <br>📅 **Affected**: Version 6.1.5 and earlier. ✅ **Fixed**: Version 6.1.6+.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Inject arbitrary JavaScript. <br>🍪 **Data Access**: Steal cookie-based authentication credentials. <br>🔄 **Impact**: Launch further attacks (e.g., CSRF, phishing) within the site context.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚖️ **Threshold**: Medium. <br>🔑 **Auth**: PR:N (Privileges Required: None) for vector, but UI:R (User Interaction Required). <br>👤 **Requirement**: Victim must click a malicious link.…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: Yes, Public. <br>📂 **PoC**: Available on GitHub (Alucard0x1). <br>🔎 **Scanner**: Nuclei templates exist. 🌍 **Wild Exploitation**: High potential due to easy PoC generation and UI:R nature.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for `post_status` parameter reflection. <br>🧪 **Test**: Use PoC URL generator to inject `<script>alert(1)</script>`. <br>📊 **Scan**: Run Nuclei template `CVE-2023-30777.yaml`.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. <br>🔄 **Patch**: Upgrade to Advanced Custom Fields PRO v6.1.6 or later. <br>📝 **Note**: Official vendor release addresses the sanitization issue. 📥 Action: Update immediately via WP dashboard.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1️⃣ Disable the plugin if not essential. <br>2️⃣ Implement WAF rules to block XSS payloads in `post_status`. <br>3️⃣ Educate users not to click suspicious links.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

⚡ **Priority**: Medium-High. <br>📈 **Reason**: High exploitability (PR:N) + Public PoC. <br>🎯 **Action**: Patch ASAP. Even though CVSS is Low, the ease of exploitation makes it a prime target for opportunistic attacks.…

Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) WP Engine CWE-79