CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is due to insufficient sanitization of input prior to being used in a call to the eval() function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code on the server.
Explanation of Vulnerability in Simple Terms
Custom Field Suite versions 2.6.7 and earlier allow authenticated users with low privileges to execute arbitrary PHP code on the site. The vulnerability stems from improper handling of user-supplied input in code evaluation contexts. An attacker with a basic user account can read sensitive data, modify site content, or take control of the entire installation.
What an attacker can do
Run their own PHP code on the site, read all data, and modify or delete content.
Potential impact on your site
Any user account on your site—even a basic contributor—can compromise the entire installation.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
