CVE-2020-13700

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/mariuszpoplwski/4fbaab7f271bea99c733e3f2a4bafbb5Exploit, Third Party Advisory
https://github.com/airesvsg/acf-to-rest-apiThird Party Advisory
https://wordpress.org/plugins/acf-to-rest-api/#developersRelease Notes, Third Party Advisory
https://gist.github.com/mariuszpoplwski/4fbaab7f271bea99c733e3f2a4bafbb5Exploit, Third Party Advisory
https://github.com/airesvsg/acf-to-rest-apiThird Party Advisory
https://wordpress.org/plugins/acf-to-rest-api/#developersRelease Notes, Third Party Advisory

Timeline

Published: Jun 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-1370210.0The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent CVE-2020-13717.8An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerabilit CVE-2020-137127.8A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.1 CVE-2020-13727.8An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles objects in memory,CVE-2020-13737.8An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo CVE-2020-13747.5A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De CVE-2020-13757.8An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Pri CVE-2020-1375310.0The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.CVE-2020-137546.7hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.CVE-2020-137569.8Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelecto CVE-2020-137577.5Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.CVE-2020-137586.1modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by