The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Advanced Custom Fields Plugin | — | Update advanced-custom-fields plugin to version 6.3.6.3, or a newer patched version | May 15, 2025 | Oct 7, 2024 |
| Advanced Custom Fields Pro Plugin | — | Update advanced-custom-fields-pro plugin to version 6.3.9, or a newer patched version | May 15, 2025 | Oct 7, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub