Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2024-9529

Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Secure Custom Fields

Default version status: unaffected

  • 6.3.7 to < 6.3.9affected

Unknown Secure Custom Fields

Default version status: unaffected

  • 0 to < 6.3.6.3affected

Unknown Advanced Custom Fields Pro

Default version status: unaffected

  • 0 to < 6.3.9affected

References