CVE-2024-34762

Advanced Custom Fields PRO can be steered into including a PHP file chosen via a traversal-style path, giving an attacker local file inclusion on the server. ACF is a staple of the WordPress ecosystem, so the potential footprint is large, and LFI on a PHP stack can escalate toward code execution depending on what files can be pulled into the include.

The exploitation reality is tempered by the entry requirement: it needs some authenticated access rather than being wide open, which pulls it out of the pure botnet-bait category that unauthenticated plugin RCE occupies. That said, WordPress sites frequently hand out low-privilege accounts, and the scope change means a successful include reaches beyond the plugin's own boundary, so the low bar of authentication shouldn't be mistaken for a strong wall.

Our job is the familiar plugin-inventory sweep, sharpened by the auth precondition. We map which sites run ACF PRO and at what version, then prioritize those that permit self-registration or have many low-privilege users, since those are where 'authenticated' is cheapest. For sites where accounts are tightly held, this ranks a notch below its 9.9; for open-registration sites, it's close to the full weight of that score.