This vulnerability involves improper control of code generation in the Advanced Custom Fields PRO plugin by WPENGINE INC, classified as CWE-94 (Code Injection). It permits an attacker with low privileges and no user interaction to execute code remotely over the network, impacting confidentiality, integrity, and availability with a CVSS 3.1 score of 8.5. The affected versions are those prior to 6.2.10, but no official patch or remediation guidance is currently available from the vendor or public advisories. The vulnerability was identified through a security audit and is published as CVE-2024-34761.

Successful exploitation could allow an attacker to execute arbitrary code remotely, leading to complete compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or denial of service. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity. Avoid deploying the vulnerable versions in sensitive environments if possible.