CVE-2013-1973: The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module...

Security readout for executives and security teams

This is an information-disclosure issue in the Drupal Autocomplete Widgets module. A logged-in user could obtain sensitive field values because the autocomplete callback did not properly enforce node permissions. The sources do not report unauthenticated access or active exploitation. Exposure is limited to Drupal sites using the autocomplete_widgets module in the affected 6.x or 7.x release lines. Attackers must be authenticated remote users, based on the CVE description. Treat this as a moderate-priority data exposure risk for legacy Drupal estates. Prioritize internet-facing sites and environments where sensitive node fields exist and lower-privileged authenticated users are common. Mitigation focus: Upgrade autocomplete_widgets to 6.x-1.4, 7.x-1.0-rc1, or a later fixed release.; Review the Drupal advisory pages for any version-specific guidance.; Disable the module or affected autocomplete widgets if an immediate upgrade is not possible..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.