CVE-2024-3562: Custom Field Suite WordPress RCE Vulnerability

CVE-2024-3562 Overview

The Custom Field Suite plugin for WordPress contains a PHP Code Injection vulnerability affecting all versions up to and including 2.6.7. The flaw resides in the Loop custom field, where user-controlled input flows into a call to the eval() function without sufficient sanitization. Authenticated attackers with contributor-level access or above can execute arbitrary PHP code on the underlying server. Successful exploitation grants attackers full control of the WordPress instance, including the ability to read secrets, pivot to the database, and drop web shells. The vulnerability is tracked as [CWE-95] Improper Neutralization of Directives in Dynamically Evaluated Code and [CWE-94] Improper Control of Generation of Code.

Critical Impact
Authenticated contributors can achieve arbitrary PHP code execution on WordPress servers running Custom Field Suite ≤ 2.6.7, leading to full site compromise.

Affected Products

Custom Field Suite plugin for WordPress, all versions up to and including 2.6.7
WordPress sites permitting contributor-level or higher accounts on affected plugin versions
Multisite WordPress deployments with the plugin network-activated

Discovery Timeline

2024-06-20 - CVE-2024-3562 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3562

Vulnerability Analysis

Custom Field Suite exposes a Loop field type that allows editors to define repeatable groups of fields on WordPress posts. The plugin evaluates configuration expressions associated with the Loop field using PHP's eval() builtin. Because the field values originate from post metadata that any contributor can submit, an attacker with contributor privileges can inject PHP directives that the plugin then evaluates in the WordPress process context.

The attacker does not need administrator privileges, network reconnaissance, or user interaction. A single crafted post payload is sufficient to execute arbitrary PHP once the affected Loop rendering path is triggered. See the Wordfence Vulnerability Analysis for additional context.

Root Cause

The root cause is direct use of eval() on attacker-controllable data inside the Loop field handler. The vulnerable code paths are visible at loop.php line 192 and loop.php line 224. No allowlist, type constraint, or escaping is applied before evaluation, so any PHP syntax supplied through the field is executed.

Attack Vector

An attacker authenticates to WordPress with a contributor account or higher. The attacker creates or edits a post that uses a Custom Field Suite Loop field, and supplies a payload that resolves to attacker-controlled PHP when passed to eval(). Once the affected field is processed, the injected code runs with the privileges of the PHP-FPM or web server user. Typical post-exploitation includes reading wp-config.php, extracting database credentials, and writing a persistent PHP web shell.

No verified public proof-of-concept code is available. Refer to the GitHub Documentation for Loop Field for how the field is invoked in normal operation.

Detection Methods for CVE-2024-3562

Indicators of Compromise

Unexpected PHP files, .php uploads, or web shells appearing in wp-content/uploads/ or theme directories after a Loop field edit
WordPress postmeta rows tied to Custom Field Suite Loop fields containing PHP tokens such as <?php, system(, passthru(, base64_decode(, or assert(
Outbound connections from the web server to unusual hosts shortly after contributor post save events
New or modified administrator accounts, or unexplained changes to wp_options values like siteurl and active_plugins

Detection Strategies

Audit wp_postmeta and Custom Field Suite storage tables for Loop field values containing PHP syntax or serialized payloads referencing dangerous functions
Alert on web server processes (php-fpm, apache2, httpd, www-data) spawning shells such as sh, bash, or python
Correlate WordPress audit logs of contributor post.save events with subsequent file writes under the web root
Inspect the installed plugin version via wp plugin get custom-field-suite --field=version and flag any host running 2.6.7 or older

Monitoring Recommendations

Enable WordPress audit logging for contributor and author role activity, including post metadata changes
Forward web server, PHP error, and process telemetry into a centralized analytics platform for correlation across role changes, file writes, and outbound connections
Monitor for signatures of common WordPress web shells and for integrity changes to files under wp-content/plugins/custom-field-suite/

How to Mitigate CVE-2024-3562

Immediate Actions Required

Update Custom Field Suite to a version later than 2.6.7 on every WordPress instance where the plugin is installed
Review all contributor, author, editor, and administrator accounts and revoke any that are unrecognized or inactive
Inspect posts and postmeta created or modified by non-administrator users since installation of the plugin for signs of PHP injection
Rotate WordPress secret keys in wp-config.php and reset database credentials if compromise is suspected

Patch Information

Upgrade Custom Field Suite to a release later than 2.6.7 that removes or sanitizes the eval() call in the Loop field handler. The vulnerable code lines are documented at loop.php line 192 and loop.php line 224. Verify the fix by inspecting the plugin source for direct eval() usage on user-supplied field data after upgrade.

Workarounds

Deactivate the Custom Field Suite plugin until the upgrade is applied on all sites
Restrict contributor and author account creation, and require administrator approval for new low-privilege users
Disable PHP execution in writable WordPress directories such as wp-content/uploads/ via web server configuration
Deploy a web application firewall rule that blocks POST bodies to post.php and admin-ajax.php containing PHP tag sequences in Custom Field Suite field parameters

bash

# Configuration example: identify vulnerable installations using WP-CLI
wp plugin get custom-field-suite --field=version
wp plugin deactivate custom-field-suite
wp plugin update custom-field-suite