// For flags

CVE-2024-9529

Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution

Severity Score

6.6
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to limited arbitrary function calls via the 'register_meta_box_cb' and 'meta_box_cb' parameters in all versions up to, and including, 6.3.8 (excluding 6.3.6.2) due to insufficient input validation on those parameters. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary functions, like WordPress functions, in custom post types that will execute whenever a user accesses the injected post type. This can be leveraged to trick other users like administrators accessing posts into performing unauthorized actions through functions, and is not a very serious risk for the vast majority of site owners. Please follow the reference listed in this vulnerability record for instructions on how to update to the latest version of ACF that patches this issue and ensures accessibility to updates moving forward. Please note this issue was partially patched in 6.3.8 and 6.3.6.1 - 6.3.6.2, however, was hardened further in 6.3.6.3 and 6.3.9.

*Credits: Automattic Security Team, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-10-04 CVE Reserved
  • 2024-10-07 CVE Published
  • 2024-11-15 CVE Updated
  • 2024-11-15 First Exploit
  • 2024-11-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Unknown
Search vendor "Unknown"
 Secure Custom Fields
Search vendor "Unknown" for product "Secure Custom Fields"
 >= 6.3.7 < 6.3.9
Search vendor "Unknown" for product "Secure Custom Fields" and version " >= 6.3.7 < 6.3.9"
en
Affected
Unknown
Search vendor "Unknown"
 Secure Custom Fields
Search vendor "Unknown" for product "Secure Custom Fields"
 < 6.3.6.3
Search vendor "Unknown" for product "Secure Custom Fields" and version " < 6.3.6.3"
en
Affected
Unknown
Search vendor "Unknown"
 Advanced Custom Fields Pro
Search vendor "Unknown" for product "Advanced Custom Fields Pro"
 < 6.3.9
Search vendor "Unknown" for product "Advanced Custom Fields Pro" and version " < 6.3.9"
en
Affected