The flaw was discovered by website security company Patchstack on May 2nd, 2023, and was disclosed along with a proof-of-concept exploit on May 5th, a day after the plugin vendor had released a security update with version 6.1.6.
As the Akamai Security Intelligence Group (SIG) reported yesterday, starting May 6th, 2023, they observed significant scanning and exploitation activity using the sample code provided in Patchstack's write-up.
"The Akamai SIG analyzed XSS attack data and identified attacks starting within 24 hours of the exploit PoC being made public," reads the report.
Considering that over 1.4 million websites using the impacted WordPress plugin have not upgraded to the latest version, based on wordpress.org stats, the attackers have quite a large attack surface to explore.
The XSS flaw requires the involvement of a logged-in user who has access to the plugin to run malicious code on their browser that will give the attackers high-privileged access to the site.
The malicious scans indicate that this mitigation factor doesn't dishearten threat actors who trust that they can overcome it through basic trickery and social engineering.
Also, the exploit works on default configurations of the impacted plugin versions, which increases the chances of success for the threat actors without requiring extra effort.
WordPress site administrators using the vulnerable plugins are urged to immediately apply the available patch to protect from ongoing scanning and exploitation activity.
The recommended action is to upgrade 'Advanced Custom Fields' free and pro plugins to version 5.12.6 (backported) and 6.1.6.