What’s Vulnerable › Vulnerabilities
CVE-2024-9529: Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
- Severity: medium (CVSS 6.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-11-15 · updated 2026-06-17
Description
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
Affected products
- WP Engine Advanced Custom Fields: before 6.3.9 — fixed in 6.3.9
How to fix
Upgrade to a fixed version: WP Engine Advanced Custom Fields 6.3.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-9529 or the next vulnerability affects your stack