SQL Injection Vulnerability in Custom Field Suite Plugin for WordPress

CVE-2024-3561

Summary

The Custom Field Suite plugin for WordPress is susceptible to SQL Injection through the 'Term' custom field across all versions up to and including 2.6.7. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of the SQL query execution. Attackers with contributor-level access and above may exploit this flaw to inject additional SQL commands, potentially compromising sensitive information stored in the database. Websites utilizing this plugin should take immediate measures to patch their installations to prevent unauthorized data access.

References