CVE

CVE-2020-13700

7.5

CVSS

Description

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.

Attack Vector

Privileges Req.

User Interaction

Updated Sep 28, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~15 seconds

CVE-2020-13700 Scanner

Detects 'Insecure Direct Object References (IDOR)' vulnerability in acf-to-rest-api plugin for Wordpress affects v. through 3.1.0.

Used 2.3k times · 3.3k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →