wpengine Vulnerabilities and Affected Products
Vulnerabilities associated with advanced_custom_fields.
Products
Clear product- Advanced Custom Fields (ACF®)3 vulnerabilities
- advanced_custom_field_pro3 vulnerabilities
- Database Backup for WordPress3 vulnerabilities
- wpgraphql3 vulnerabilities
- advanced_custom_fields2 vulnerabilities
- Better Search Replace1 vulnerability
- better_search_replace1 vulnerability
- Gutenberg Blocks – ACF Blocks Suite1 vulnerability
- WP Migrate Lite – Migration Made Easy1 vulnerability
- wp_migrate1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-9529MEDIUM | Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code ExecutionThe Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions. CWE-94Nov 15, 2024 | CVSS6.6v3.1 | EPSS0.435% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-4565HIGH | Advanced Custom Fields < 6.3 - Contributor+ Custom Field AccessThe Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access CWE-639Jun 20, 2024 | CVSS7.5v3.1 | EPSS0.428% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |