Arbitrary PHP Code Execution Vulnerability in Custom Field Suite for WordPress

CVE-2024-3562

Summary

The Custom Field Suite plugin for WordPress presents a vulnerability that allows PHP code injection through the Loop custom field. This issue arises from inadequate sanitization of user input, specifically prior to its use in the eval() function. Attackers with authenticated access at the contributor level or above can exploit this vulnerability to execute arbitrary PHP code on the server. This could lead to unauthorized access, data corruption, or further security incidents. It is crucial for users utilizing affected versions to apply necessary updates to mitigate these security risks.

References