Arbitrary PHP Code Execution Vulnerability in Custom Field Suite for WordPress

CVE-2024-3562

What is CVE-2024-3562?

The Custom Field Suite plugin for WordPress presents a vulnerability that allows PHP code injection through the Loop custom field. This issue arises from inadequate sanitization of user input, specifically prior to its use in the eval() function. Attackers with authenticated access at the contributor level or above can exploit this vulnerability to execute arbitrary PHP code on the server. This could lead to unauthorized access, data corruption, or further security incidents. It is crucial for users utilizing affected versions to apply necessary updates to mitigate these security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References