SQL Injection Vulnerability in Custom Field Suite Plugin for WordPress

CVE-2024-3561

What is CVE-2024-3561?

The Custom Field Suite plugin for WordPress is susceptible to SQL Injection through the 'Term' custom field across all versions up to and including 2.6.7. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of the SQL query execution. Attackers with contributor-level access and above may exploit this flaw to inject additional SQL commands, potentially compromising sensitive information stored in the database. Websites utilizing this plugin should take immediate measures to patch their installations to prevent unauthorized data access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References