CVE-2024-34761 Overview
CVE-2024-34761 is a code injection vulnerability affecting WPENGINE INC Advanced Custom Fields PRO, a widely deployed WordPress plugin. The flaw stems from improper control of code generation, classified under [CWE-94]. Contributors with authenticated access can execute arbitrary functions on affected WordPress installations. The issue affects all versions of Advanced Custom Fields PRO before 6.2.10. Researchers discovered the vulnerability during a planned security audit and disclosed it through Patchstack.
Critical Impact
Authenticated contributors can trigger arbitrary function execution, leading to full compromise of confidentiality, integrity, and availability on affected WordPress sites.
Affected Products
- Advanced Custom Fields PRO versions prior to 6.2.10
- WordPress sites using WPENGINE INC Advanced Custom Fields PRO plugin
- Any WordPress deployment permitting contributor-level accounts on vulnerable plugin versions
Discovery Timeline
- 2024-06-10 - CVE-2024-34761 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34761
Vulnerability Analysis
The vulnerability resides in Advanced Custom Fields PRO, a plugin used to build custom fields for WordPress content. The plugin improperly controls how PHP code and function names are handled when processing field configuration or rendering logic. An attacker with contributor privileges can supply crafted input that causes the plugin to invoke arbitrary PHP functions in the context of the WordPress process. This enables the attacker to read sensitive data, modify content, and disrupt site availability. The exploitation path requires authentication and elevated attack complexity, but the impact on the compromised site is complete.
Root Cause
The root cause is improper control of code generation, tracked as [CWE-94] Code Injection. The plugin accepts user-controllable input that flows into a dynamic function invocation without adequate validation or allow-listing. Because the input influences which callable executes, attackers with limited privileges can escalate their effective capability to arbitrary function execution.
Attack Vector
Exploitation occurs over the network against the WordPress admin interface. The attacker must hold a contributor account or equivalent authenticated role. The attacker submits crafted field configuration data that reaches the vulnerable function-invocation path. Once processed, the plugin executes attacker-chosen PHP functions. The scope changes because the executed code runs in the WordPress process context and can affect resources beyond the attacker's original privilege boundary. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-34761
Indicators of Compromise
- Unexpected PHP function invocations initiated from Advanced Custom Fields PRO code paths in web server or PHP-FPM logs
- New or modified custom field definitions authored by contributor-role accounts with unusual payloads
- Outbound network connections from the WordPress host to unfamiliar destinations following field configuration changes
- Creation of PHP files, cron jobs, or administrator accounts shortly after contributor activity
Detection Strategies
- Audit the wp_posts and wp_postmeta tables for ACF field configurations containing suspicious callable references or serialized payloads
- Correlate contributor-account activity with plugin configuration changes and immediate follow-on file system writes
- Enable WordPress audit logging plugins to record post revisions, meta updates, and privilege changes
Monitoring Recommendations
- Track the installed version of Advanced Custom Fields PRO across all WordPress sites and alert on any version below 6.2.10
- Monitor PHP error and access logs for anomalous function-execution errors originating from advanced-custom-fields-pro paths
- Alert on contributor accounts performing actions typically reserved for editors or administrators
How to Mitigate CVE-2024-34761
Immediate Actions Required
- Upgrade Advanced Custom Fields PRO to version 6.2.10 or later on every WordPress installation
- Review all contributor and higher-privileged accounts and remove any that are unnecessary or inactive
- Rotate credentials for accounts that could have interacted with the plugin during the exposure window
- Inspect recent post meta and field configurations for injected callable references
Patch Information
WPENGINE INC addressed the vulnerability in Advanced Custom Fields PRO version 6.2.10. Administrators should apply the update through the WordPress plugin management interface or by deploying the updated plugin package. Full remediation details are available in the Patchstack Vulnerability Report.
Workarounds
- Restrict contributor account creation and require multi-factor authentication for all authenticated WordPress roles
- Deploy a web application firewall rule set that blocks suspicious ACF field configuration payloads until patching completes
- Temporarily disable Advanced Custom Fields PRO on sites where immediate patching is not feasible
- Enforce least-privilege review so contributor accounts cannot modify field definitions on production sites
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
