wpengine advanced custom field pro vulnerabilities

Latest wpengine advanced custom field pro CVEs

Newest publication first

1. CVE-2024-9529 Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution

   Published 2024-11-15

   Medium·CVSS 6.6 EPSS 0.43%

   The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could a...

2. CVE-2024-4565 Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

   Published 2024-06-20

   Medium·CVSS 6.5 EPSS 0.48%

   The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access

3. CVE-2024-34762 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability

   Published 2024-06-10

   Critical·CVSS 9.9 EPSS 0.59%

   Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.