CVE-2024-37251: Advanced Custom Fields PRO CSRF Vulnerability

CVE-2024-37251 Overview

CVE-2024-37251 is a Cross-Site Request Forgery (CSRF) vulnerability affecting WPEngine's Advanced Custom Fields PRO plugin for WordPress. The flaw exists in all versions before 6.3.2 and is tracked under [CWE-352]. An attacker can trick an authenticated user into submitting a forged request that performs state-changing actions in the plugin without their consent.

Exploitation requires user interaction, typically by luring an authenticated administrator or editor to a malicious page. The vulnerability was published to the National Vulnerability Database (NVD) on December 16, 2024.

Critical Impact
Successful exploitation allows attackers to perform limited unauthorized actions in the context of an authenticated Advanced Custom Fields PRO user, impacting data integrity within the WordPress site.

Affected Products

WPEngine Advanced Custom Fields PRO (all versions before 6.3.2)
WordPress installations using vulnerable ACF PRO releases
Sites where ACF PRO is active with authenticated administrative sessions

Discovery Timeline

2024-12-16 - CVE-2024-37251 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37251

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF token validation in one or more state-changing endpoints exposed by Advanced Custom Fields PRO. WordPress plugins are expected to validate nonces on requests that modify configuration or content. When the plugin fails to verify the origin of a request, the browser will forward the victim's authentication cookies to the target site.

An attacker crafts a webpage or email containing a request targeting the vulnerable endpoint. If a logged-in user visits the malicious page, the browser submits the request with valid session credentials. The plugin processes the action as if it were legitimate.

The issue is limited in scope. Confidentiality is not impacted, integrity is impacted at a low level, and availability is unaffected. Full technical detail is available in the Patchstack CSRF Vulnerability Report.

Root Cause

The root cause is the absence or improper enforcement of anti-CSRF protections, such as WordPress wp_nonce_field() generation and check_admin_referer() or wp_verify_nonce() validation, on privileged plugin actions in versions before 6.3.2.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker hosts a malicious page containing a hidden form or JavaScript that auto-submits a request to the target WordPress site. The victim must have an active authenticated session with ACF PRO privileges for the request to succeed.

No verified public exploit code is available for this vulnerability. See the referenced Patchstack advisory for a detailed technical description.

Detection Methods for CVE-2024-37251

Indicators of Compromise

Unexpected modifications to ACF PRO field groups, settings, or configurations without corresponding administrator activity in audit logs
Web server access logs showing POST requests to ACF PRO admin endpoints with external Referer headers or missing nonce parameters
Authenticated administrator sessions originating from browsers immediately after visiting untrusted external sites

Detection Strategies

Audit installed ACF PRO plugin versions across all WordPress sites and flag any instance older than 6.3.2
Monitor WordPress activity logs for configuration changes originating from unusual referrers or unexpected times
Correlate browser telemetry with WordPress admin activity to identify request forgery patterns

Monitoring Recommendations

Enable verbose WordPress audit logging via a security plugin to capture all ACF PRO administrative actions
Alert on POST requests to /wp-admin/ endpoints missing the expected _wpnonce parameter
Track outbound navigation from administrator workstations to newly registered or low-reputation domains

How to Mitigate CVE-2024-37251

Immediate Actions Required

Upgrade Advanced Custom Fields PRO to version 6.3.2 or later on all WordPress installations
Force logout of all active administrator and editor sessions after patching to invalidate any long-lived cookies
Review recent ACF PRO configuration changes for unauthorized modifications during the exposure window

Patch Information

WPEngine addressed the issue in Advanced Custom Fields PRO version 6.3.2. Administrators should update through the WordPress plugin dashboard or by replacing the plugin files. Refer to the Patchstack CSRF Vulnerability Report for advisory details.

Workarounds

Restrict WordPress admin access to trusted IP ranges via web server or firewall rules until patching is complete
Deploy a web application firewall (WAF) rule that blocks state-changing requests to ACF PRO endpoints lacking a valid _wpnonce parameter
Require administrators to use dedicated browsers or isolated sessions for WordPress management to reduce cross-site exposure

bash

# Configuration example: update ACF PRO via WP-CLI
wp plugin update advanced-custom-fields-pro --version=6.3.2
wp plugin get advanced-custom-fields-pro --field=version