CVE-2024-3561: Custom Field Suite SQL Injection Flaw

CVE-2024-3561 Overview

The Custom Field Suite plugin for WordPress contains a SQL injection vulnerability in the Term custom field. The flaw affects all versions up to and including 2.6.7. It stems from insufficient escaping of user-supplied parameters and lack of proper query preparation in the underlying SQL statement.

Authenticated attackers with contributor-level access or above can append additional SQL queries into existing statements. This allows extraction of sensitive information from the WordPress database, including credentials, session tokens, and private post data. The issue is tracked as CWE-89 SQL Injection.

Critical Impact
Authenticated contributors can execute arbitrary SQL against the WordPress database, exposing user credentials, secrets, and private content stored in wp_users, wp_usermeta, and wp_options.

Affected Products

Custom Field Suite plugin for WordPress, all versions up to and including 2.6.7
WordPress sites where the plugin is installed and activated
Sites permitting contributor-level or higher user registrations

Discovery Timeline

2024-06-20 - CVE-2024-3561 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3561

Vulnerability Analysis

The vulnerability resides in the Term field handler of the Custom Field Suite plugin, specifically in includes/fields/term.php. When the plugin processes the term field parameter, it interpolates user input directly into a SQL query without adequate escaping or the use of prepared statements.

Authenticated users with contributor privileges or higher can supply crafted input that breaks out of the intended query context. The injected payload becomes part of the SQL statement executed against the WordPress database. Because the injection point occurs in an already-authenticated context, exploitation does not require additional bypasses.

Successful exploitation yields read access to any table in the WordPress schema. Attackers commonly target wp_users for password hashes and wp_usermeta for session tokens or capability arrays. See the Wordfence Vulnerability Report for additional technical context.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The plugin concatenates user-controlled data into a query string rather than using the $wpdb->prepare() API with parameterized placeholders. The vulnerable code path can be reviewed in the GitHub Code Snippet.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user with the edit_posts capability. Contributors submit content that includes a Term custom field, and the malicious SQL payload is embedded in the field value. When the plugin processes the submission or renders the field, the injected SQL executes with database privileges of the WordPress application user.

The vulnerability manifests when unsanitized field input reaches the SQL query construction step. See the WordPress Plugin Overview and GitHub Documentation Page for information on how the Term field is intended to be used.

Detection Methods for CVE-2024-3561

Indicators of Compromise

Unexpected SQL syntax fragments such as UNION SELECT, SLEEP(, or information_schema in WordPress request logs targeting admin-ajax or post editor endpoints
New or modified administrator accounts in wp_users following contributor activity
Anomalous outbound database queries or elevated query volume from the WordPress application user
Contributor accounts submitting posts containing Term custom fields with unusual characters like ', --, or /*

Detection Strategies

Enable MySQL general query logging and search for queries referencing the Custom Field Suite Term field with suspicious operators
Deploy a web application firewall rule to inspect POST parameters bound to Custom Field Suite for SQL metacharacters
Audit WordPress access logs for contributor-level accounts making repeated requests to post.php or admin-ajax.php with abnormal payloads

Monitoring Recommendations

Alert on creation of new users with elevated roles following contributor post submissions
Monitor for changes to sensitive wp_options entries such as siteurl, admin_email, and active_plugins
Track database error responses returned to authenticated non-admin users, which often indicate injection probing

How to Mitigate CVE-2024-3561

Immediate Actions Required

Update the Custom Field Suite plugin to a version later than 2.6.7 as soon as a fixed release is available from the vendor
Audit all contributor, author, and editor accounts and remove any that are not required
Review the wp_users table for unauthorized administrator accounts and rotate credentials for existing users
Restrict contributor-level registration on public WordPress sites until patching is complete

Patch Information

At the time of the NVD entry, the Custom Field Suite plugin was reported vulnerable through version 2.6.7. Site administrators should consult the WordPress Plugin Overview for the latest release information and apply any newer version that addresses the SQL injection issue in includes/fields/term.php.

Workarounds

Deactivate and remove the Custom Field Suite plugin until a fixed version can be installed
Restrict the edit_posts capability so that only trusted, vetted users receive contributor role or higher
Deploy a WordPress security plugin or WAF ruleset that inspects and blocks SQL injection payloads on plugin endpoints
Enforce least-privilege on the MySQL user configured in wp-config.php to limit read access to sensitive tables where feasible

bash

# Example: disable the plugin from the command line using WP-CLI
wp plugin deactivate custom-field-suite
wp plugin delete custom-field-suite

# Example: audit contributor and higher accounts
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
wp user list --role=author --fields=ID,user_login,user_email,user_registered