CVE-2024-9529

Executive Summary

CVE-2024-9529 is a critical security vulnerability affecting the WordPress ecosystem, specifically the Secure Custom Fields and Advanced Custom Fields Pro plugins developed by WP Engine. The flaw resides in the plugin's setting import functionality, which fails to properly sanitize or restrict the functions that can be executed during the import process. This allows a high-privilege user (e.g., an administrator) to run arbitrary PHP functions, leading to complete site compromise.

The vulnerability is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). While the CVSS score is listed as 0.0 in the NVD data, this is likely a placeholder; the actual severity is high due to the potential for arbitrary code execution. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the risk remains significant for unpatched sites.

Supply Chain & Package Security

This vulnerability affects WordPress plugins distributed via the official WordPress plugin repository and commercial channels. Administrators should verify the integrity of plugin updates by checking checksums or signatures provided by WP Engine. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 7.2 (High).

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An attacker must have administrator-level access to the WordPress site.
• User Interaction (UI): None – No user action is needed beyond the attacker's own actions.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full read access to the database and files.
• Integrity (I): High – Full write access to the database and files.
• Availability (A): High – Full control to disrupt services.

Threat Level: High. While the privilege requirement limits the attack surface, a compromised admin account or a malicious insider can achieve complete site takeover.

Deep Dive & Mechanics

The vulnerability exists in the plugin's setting import functionality, which is designed to allow administrators to import field configurations from a JSON file. The import process does not properly validate the functions that can be called during the import, allowing an attacker to inject arbitrary PHP functions.

Root Cause: The plugin uses call_user_func or similar PHP functions to execute callbacks during the import process without restricting the allowed functions. An attacker can craft a malicious JSON payload that includes a function name like system, exec, or phpinfo to execute arbitrary code.

Attack Flow:

1. An attacker gains administrator access to a WordPress site (e.g., via credential theft or social engineering).
2. The attacker navigates to the Advanced Custom Fields settings page and uses the import functionality.
3. The attacker uploads a specially crafted JSON file containing a malicious function call.
4. The plugin executes the function, allowing the attacker to run arbitrary PHP code.
5. The attacker can then install backdoors, exfiltrate data, or take full control of the site.

Vulnerable vs. Patched Code

Vulnerable Code (Simplified Example):

// In vulnerable version, the import function directly calls user-supplied functions
function import_settings($data) {
    foreach ($data['functions'] as $function_name) {
        call_user_func($function_name); // No sanitization
    }
}

Patched Code (Version 6.3.9):

// In patched version, the allowed functions are whitelisted
function import_settings($data) {
    $allowed_functions = ['acf_validate_field', 'acf_update_field'];
    foreach ($data['functions'] as $function_name) {
        if (in_array($function_name, $allowed_functions)) {
            call_user_func($function_name);
        } else {
            // Log or reject
        }
    }
}

The patch introduces a whitelist of allowed functions, preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Advanced Custom Fields plugin version < 6.3.9.
• Administrator credentials.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Custom Fields > Tools > Import.
3. Prepare a malicious JSON file with the following structure:

   {
     "functions": ["system"],
     "args": ["id"]
   }
   

4. Upload the file and trigger the import.
5. The system("id") command will execute, revealing the server user.

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor for unusual admin activity, especially imports of custom field settings.
• Look for HTTP requests to /wp-admin/admin.php?page=acf-tools&tool=import with POST data containing JSON payloads.
• Check server logs for unexpected PHP function calls (e.g., system, exec, shell_exec).

Honeypot:

• Deploy a fake admin account with low privileges and monitor for login attempts.
• Use a WordPress security plugin (e.g., Wordfence) to log all admin actions.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected PHP files in wp-content/uploads/ or wp-content/plugins/.
  • Modified .htaccess files with malicious redirects.
• Database:
  • Suspicious entries in wp_options table (e.g., acf_field_groups with malicious serialized data).
• Network:
  • Outbound connections to unknown IPs from the web server.
  • Unusual POST requests to /wp-admin/admin.php?page=acf-tools&tool=import.
• Logs:
  • PHP error logs showing call_user_func with unexpected function names.
  • Web server access logs with POST to import endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_9529_WordPress_ACF_Import {
    meta:
        description = "Detects malicious JSON payloads targeting CVE-2024-9529 in Advanced Custom Fields plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9529"
    strings:
        $json_payload = /"functions"\s*:\s*\[/ nocase
        $dangerous_func = /"system"|"exec"|"shell_exec"|"passthru"|"popen"|"proc_open"|"eval"|"assert"/
    condition:
        $json_payload and $dangerous_func
}

Sigma Rule

title: CVE-2024-9529 - Advanced Custom Fields Import Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit arbitrary PHP function execution via ACF import
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=acf-tools&tool=import'
    condition: selection
falsepositives:
    - Legitimate admin imports of field configurations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9529 - ACF Import Arbitrary Function Execution";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin.php";
    http_uri;
    content:"page=acf-tools&tool=import";
    http_uri;
    content:"functions";
    http_client_body;
    pcre:"/\"functions\"\s*:\s*\[/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 6.3.9 or later for Secure Custom Fields and Advanced Custom Fields Pro. For Secure Custom Fields, ensure version 6.3.6.3 or later.
2. Review admin accounts and remove any unauthorized or suspicious users.
3. Audit recent imports of custom field settings for malicious payloads.

Long-term Mitigations:

• Implement least privilege for WordPress admin accounts.
• Enable two-factor authentication (2FA) for all admin users.
• Use a Web Application Firewall (WAF) to block malicious POST requests.
• Regularly back up the WordPress site and database.
• Monitor WordPress security advisories for plugin updates.

Workaround (if patching is not immediately possible):

• Disable the import functionality by removing the acf-tools page via a custom plugin or .htaccess rule:

  RewriteRule ^wp-admin/admin\.php\?page=acf-tools - [F,L]
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert