PT-2024-39679 · WordPress · Secure Custom Fields+1

Published 2024-10-06 · Updated 2025-06-11 · CVE-2024-9529

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Secure Custom Fields WordPress plugin versions prior to 6.3.9 Advanced Custom Fields Pro WordPress plugin versions prior to 6.3.9

Description The issue allows high privilege users, such as admins, to run arbitrary PHP functions through the setting import functionalities, which could lead to code injection. This could enable attackers to execute arbitrary code.

Recommendations For Secure Custom Fields WordPress plugin versions prior to 6.3.9, upgrade to version 6.3.9 or later. For Advanced Custom Fields Pro WordPress plugin versions prior to 6.3.9, upgrade to version 6.3.9 or later. As a temporary workaround, consider restricting access to the setting import functionalities until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2024-9529

Affected Products

Advanced Custom Fields Pro

Secure Custom Fields

References · 9

• 🔥 https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9529 · Security Note
• https://t.me/cvenotify/125377 · Telegram Post
• https://twitter.com/oktsec/status/1857327080490271141 · Twitter Post
• https://t.me/cvedetector/11049 · Telegram Post
• https://t.me/cvenotify/101793 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1843043296446235053 · Twitter Post
• https://twitter.com/CVEnew/status/1857352288307908625 · Twitter Post