CVE-2024-9529

CWE-94 — Code Injection3 documents3 sources
Severity
6.6MEDIUM
EPSS
0.2%
top 59.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Unknown Advanced Custom Fields PROUnknown Secure Custom FieldsAdvancedcustomfields Advanced Custom Fields
Timeline
PublishedNov 15

Description

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LExploitability: 2.3 | Impact: 3.7

Affected Packages3 packages

▶CVEListV5unknown/secure_custom_fields6.3.7 — 6.3.9+1

🔴Vulnerability Details

2
CVEList
Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution↗2024-11-15
▶
GHSA
GHSA-w9hg-9q36-xm67: The Secure Custom Fields WordPress plugin before 6↗2024-11-15
▶
CVE-2024-9529 (MEDIUM CVSS 6.6) | The Secure Custom Fields WordPress | cvebase.io