Which products and versions are affected by CVE-2020-13700?

Affected: Acf To Rest API (Acf To Rest API Project); airesvsg/acf-to-rest-api (composer). The full list is in the CVE brief.

Is CVE-2020-13700 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2020-13700 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2020-13700?

No public exploit code is known.

Is there a fix for CVE-2020-13700?

Fixed versions are available, including Acf To Rest API <=3.1.0, Acf To Rest API 3.3.0, Acf To Rest API 3.1.0.

How urgently should CVE-2020-13700 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2020-13700

Q: What is CVE-2020-13700?

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress.

Q: How urgently should CVE-2020-13700 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

High

acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation

Published May 24, 2022 · Updated Jul 9, 2026 · Also known as 738e5946-65e4-4403-bb23-f84910289a45, GHSA-r345-x8hr-2r9p

Key Facts

Patch in the next maintenance window

CVE-2020-13700 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Acf To Rest API (Acf To Rest API Project), airesvsg/acf-to-rest-api (composer).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 13% probability of exploitation in the next 30 days.
Fixed versions are available, including Acf To Rest API <=3.1.0, Acf To Rest API 3.3.0, Acf To Rest API 3.1.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

13%

Higher than 96.4% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2020-13700 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
Acf To Rest APIAcf To Rest API Project	See advisory	3.1.0
airesvsg/acf-to-rest-apicomposer	See advisory	n/a

Patched Releases

Acf To Rest API

<=3.1.0, 3.3.0

Timeline

Publicly disclosed
May 24, 2022
Last updated
Jul 9, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-639 Authorization Bypass Through User-Controlled Key

References

2 more references in the full CVE brief

FAQ

Common Questions.

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress.
Affected: Acf To Rest API (Acf To Rest API Project); airesvsg/acf-to-rest-api (composer). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Acf To Rest API <=3.1.0, Acf To Rest API 3.3.0, Acf To Rest API 3.1.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2020-13700 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo