Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities found for advanced_custom_field_pro by wpengine

    CVE-2024-9529 (GCVE-0-2024-9529)

    Vulnerability from nvd – Published: 2024-11-15 06:00 – Updated: 2024-11-15 18:38
    VLAI
    Title
    Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
    Summary
    The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
    Severity
    6.6 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-11-15 18:32 UTC
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1536 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/dd3cc8d8-4dff-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Secure Custom Fields Affected: 6.3.7 , < 6.3.9 (semver)
    		Create a notification for this product.
    Unknown Secure Custom Fields Affected: 0 , < 6.3.6.3 (semver)
    		Create a notification for this product.
    Unknown Advanced Custom Fields Pro Affected: 0 , < 6.3.9 (semver)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    wpengine advanced_custom_fields Affected: 0 , < 6.3.6.3 (semver)
    Affected: 6.3.7 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Automattic Security Team WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_fields",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.6.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "6.3.7",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9529",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T18:32:21.308252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T18:38:37.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "6.3.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Automattic Security Team"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T06:00:08.369Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Secure Custom Fields \u003c 6.3.6.3 - Admin+ Remote Code Execution",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-9529",
    "datePublished": "2024-11-15T06:00:08.369Z",
    "dateReserved": "2024-10-04T15:01:44.589Z",
    "dateUpdated": "2024-11-15T18:38:37.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-4565 (GCVE-0-2024-4565)

    Vulnerability from nvd – Published: 2024-06-20 06:00 – Updated: 2025-08-27 12:00
    VLAI
    Title
    Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
    Summary
    The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-06-20 13:40 UTC
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1536 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/430224c4-d6e3-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Advanced Custom Fields (ACF) Affected: 0 , < 6.3 (semver)
    		Create a notification for this product.
    Unknown Advanced Custom Fields Pro Affected: 0 , < 6.3 (semver)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , < 6.3 (custom)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    wpengine advanced_custom_fields Affected: 0 , < 6.3 (custom)
        cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Scott Kingsley Clark WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "advanced_custom_fields",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-4565",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T13:40:36.821631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T13:42:56.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:47:40.536Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields (ACF)",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Scott Kingsley Clark"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-27T12:00:41.514Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Advanced Custom Fields \u003c 6.3 - Contributor+ Custom Field Access",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-4565",
    "datePublished": "2024-06-20T06:00:02.546Z",
    "dateReserved": "2024-05-06T19:04:45.951Z",
    "dateUpdated": "2025-08-27T12:00:41.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-34762 (GCVE-0-2024-34762)

    Vulnerability from nvd – Published: 2024-06-10 15:38 – Updated: 2026-04-28 16:09
    VLAI
    Title
    Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability
    Summary
    Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
    Severity
    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-06-10 18:36 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard C 75/100 over 2805 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    WPENGINE INC Advanced Custom Fields PRO Affected: n/a , < 6.2.10 (custom)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , ≤ 6.2.10 (custom)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    WPEngine Patchstack
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThanOrEqual": "6.2.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34762",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T18:36:56.281836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T18:57:55.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.130Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-local-file-inclusion-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields PRO",
          "vendor": "WPENGINE INC",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.2.10",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.2.10",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "WPEngine"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Patchstack"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVulnerability discovered by executing a planned security audit.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003eImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.\u003cp\u003eThis issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerability discovered by executing a planned security audit.\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-252",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-252 PHP Local File Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:09:50.172Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-local-file-inclusion-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 6.2.10 or a higher version."
            }
          ],
          "value": "Update to 6.2.10 or a higher version."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Wordpress Advanced Custom Fields Pro plugin \u003c 6.2.10 - Contributor+ Local File Inclusion vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-34762",
    "datePublished": "2024-06-10T15:38:40.493Z",
    "dateReserved": "2024-05-08T12:03:07.438Z",
    "dateUpdated": "2026-04-28T16:09:50.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-9529 (GCVE-0-2024-9529)

    Vulnerability from cvelistv5 – Published: 2024-11-15 06:00 – Updated: 2024-11-15 18:38
    VLAI
    Title
    Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
    Summary
    The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
    Severity
    6.6 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-11-15 18:32 UTC
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1536 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/dd3cc8d8-4dff-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Secure Custom Fields Affected: 6.3.7 , < 6.3.9 (semver)
    		Create a notification for this product.
    Unknown Secure Custom Fields Affected: 0 , < 6.3.6.3 (semver)
    		Create a notification for this product.
    Unknown Advanced Custom Fields Pro Affected: 0 , < 6.3.9 (semver)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    wpengine advanced_custom_fields Affected: 0 , < 6.3.6.3 (semver)
    Affected: 6.3.7 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Automattic Security Team WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_fields",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.6.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "6.3.7",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9529",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T18:32:21.308252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T18:38:37.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "6.3.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Automattic Security Team"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T06:00:08.369Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Secure Custom Fields \u003c 6.3.6.3 - Admin+ Remote Code Execution",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-9529",
    "datePublished": "2024-11-15T06:00:08.369Z",
    "dateReserved": "2024-10-04T15:01:44.589Z",
    "dateUpdated": "2024-11-15T18:38:37.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-4565 (GCVE-0-2024-4565)

    Vulnerability from cvelistv5 – Published: 2024-06-20 06:00 – Updated: 2025-08-27 12:00
    VLAI
    Title
    Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
    Summary
    The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-06-20 13:40 UTC
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1536 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/430224c4-d6e3-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Advanced Custom Fields (ACF) Affected: 0 , < 6.3 (semver)
    		Create a notification for this product.
    Unknown Advanced Custom Fields Pro Affected: 0 , < 6.3 (semver)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , < 6.3 (custom)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    wpengine advanced_custom_fields Affected: 0 , < 6.3 (custom)
        cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Scott Kingsley Clark WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "advanced_custom_fields",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-4565",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T13:40:36.821631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T13:42:56.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:47:40.536Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields (ACF)",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Scott Kingsley Clark"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-27T12:00:41.514Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Advanced Custom Fields \u003c 6.3 - Contributor+ Custom Field Access",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-4565",
    "datePublished": "2024-06-20T06:00:02.546Z",
    "dateReserved": "2024-05-06T19:04:45.951Z",
    "dateUpdated": "2025-08-27T12:00:41.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-34762 (GCVE-0-2024-34762)

    Vulnerability from cvelistv5 – Published: 2024-06-10 15:38 – Updated: 2026-04-28 16:09
    VLAI
    Title
    Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability
    Summary
    Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
    Severity
    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-06-10 18:36 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    Patchstack CNA under the mitre root
    CNA scorecard C 75/100 over 2805 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    WPENGINE INC Advanced Custom Fields PRO Affected: n/a , < 6.2.10 (custom)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , ≤ 6.2.10 (custom)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    WPEngine Patchstack
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThanOrEqual": "6.2.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34762",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T18:36:56.281836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T18:57:55.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.130Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-local-file-inclusion-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields PRO",
          "vendor": "WPENGINE INC",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.2.10",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.2.10",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "WPEngine"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Patchstack"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVulnerability discovered by executing a planned security audit.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003eImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.\u003cp\u003eThis issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerability discovered by executing a planned security audit.\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-252",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-252 PHP Local File Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:09:50.172Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-local-file-inclusion-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 6.2.10 or a higher version."
            }
          ],
          "value": "Update to 6.2.10 or a higher version."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Wordpress Advanced Custom Fields Pro plugin \u003c 6.2.10 - Contributor+ Local File Inclusion vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-34762",
    "datePublished": "2024-06-10T15:38:40.493Z",
    "dateReserved": "2024-05-08T12:03:07.438Z",
    "dateUpdated": "2026-04-28T16:09:50.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}