A recently patched critical vulnerability affecting the WordPress plugin “Advanced Custom Fields” is under active exploitation by malicious threat actors, who began targeting the flaw just twenty-four (24) hours after researchers published a working proof-of-concept (PoC) exploit. Advanced Custom Fields is a WordPress plugin which allows users to add extra content fields (commonly referred to as Custom Fields) to WordPress edit screens, allowing them to develop websites faster and disseminate information to visitors more quickly. The vulnerability, tracked as CVE-2023-30777, is a reflected cross-site scripting (XSS) flaw in which attackers inject malicious code into a victim website for distribution to the visitors of that site. If exploited, the XSS flaw could allow unauthenticated attackers who’ve gained access to the Advanced Custom Fields plugin to escalate their privileges and exfiltrate sensitive information from vulnerable WordPress sites. Although this vulnerability is severe, the exploitation requires prior access to the victim’s plugin. These factors resulted in the vulnerability being assessed a CVSS score of 7.1/10. This vulnerability was patched on May 5, 2023, and CTIX analysts recommend that all users leveraging Advanced Custom Fields and Advanced Custom Fields Pro upgrade to version 6.1.6 or later immediately to prevent exploitation.