Vulnerability · Published Nov 15, 2024 · Assigned by WPScan
CVE-2024-9529Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
Medium 6.6
In plain English
A medium-severity security flaw in Advanced Custom Fields Pro from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.4%top 62.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Secure Custom Fields | 6.3.7 – before 6.3.9 |
| Unknown | Secure Custom Fields | 0 – before 6.3.6.3 |
| Unknown | Advanced Custom Fields Pro | 0 – before 6.3.9 |
References
- https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/ exploit, vdb-entry, technical-description