WP Engine Advanced Custom Fields PRO Code Injection Vulnerability

A code injection vulnerability allowing arbitrary code execution has been identified in the WP Engine Advanced Custom Fields PRO plugin, affecting versions prior to 6.2.10. This vulnerability arises from improper control over code generation, which could be exploited by contributors to execute malicious code remotely.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected WordPress site.

Remediation

Users of the Advanced Custom Fields PRO WordPress plugin should update to version 6.2.10 or later. Patchstack users can enable auto-updates for vulnerable plugins.