CVE-2024-3562

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-3562
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3562.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-3562
Published
2024-06-20T02:15:10Z
Modified
2025-01-14T12:14:45.418935Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is due to insufficient sanitization of input prior to being used in a call to the eval() function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code on the server.

References

Affected packages

Git / github.com/mgibbs189/custom-field-suite

Affected ranges

Type
GIT
Repo
https://github.com/mgibbs189/custom-field-suite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected

Affected versions

1.*

1.7.8
1.7.9
1.8.0
1.8.1
1.8.2
1.8.3
1.8.5
1.8.6
1.8.8
1.8.9
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9

2.*

2.0.2
2.0.3
2.0.4
2.0.5
2.1.0
2.1.1
2.2.0
2.2.2
2.3.0
2.3.11
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.4
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5
2.5.1
2.5.10
2.5.11
2.5.12
2.5.13
2.5.14
2.5.15
2.5.16
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.6.1
2.5.7
2.5.8
2.5.9
2.6
2.6.2
2.6.2.1
2.6.4
2.6.5
2.6.7