Secure Custom Fields by WordPress.org

Blog post on wordpress.org concerning this: https://wordpress.org/news/2024/10/secure-custom-fields/

> There is separate, but not directly related news that Jason Bahl has left WP Engine to work for Automattic and will be making WPGraphQL a canonical community plugin. We expect others will follow as well.

Anything to prop up their position and throw the company they are attacking under the bus. What a jerk.

  This is a rare and unusual situation brought on by WP Engine’s legal attacks, we do not anticipate this happening for other plugins.

Yeah, that is not how trust works.

> This update is as minimal as possible to fix the security issue.

What is the actual issue? CVE number?

I think they mean that it's developed by WP Engine and that's the security issue.

Details haven't been made public yet: https://www.cve.org/CVERecord?id=CVE-2024-9529

Though, Automattic posted publicly that there was a vulnerability shortly after filing the CVE, while simultaneously blocking WPEngine from being able to push a fix to it because they'd cut off access to wp.org

I can’t find the actual number because Automattic’s tweet[1] announcing it has been deleted, but it’s the one mentioned in the ACF 6.3.8 release notes[2]. The authors of ACF can’t upload that version to wordpress.org themselves because Matt banned them from there before making the announcement.

ETA: Matt says[3] it’s a different vulnerability. Anybody willing to break out the almighty diff?

[1] Discussed at the time: https://news.ycombinator.com/item?id=41752289

[2] https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

[3] https://news.ycombinator.com/item?id=41821829

The diff contains two (identical) changes that aren't just ripping out upgrade notices for the pro version: Two functions that stop callbacks from accessing $_POST now also stop them from accessing $_REQUEST, which also contains everything in $_POST. Also confirmed by WP Engine's update notice[1].

I honestly don't see why anyone would treat this as a security issue. Everything involved is PHP code that can do whatever it wants, not in any kind of sandbox.

Edit: And even if it were this update doesn't fix the problem. POST variables can still be accessed:

    filter_input(INPUT_POST, 'name');

[1]: https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

Which, by the way, previously ended with "We expect others will defect as well." before the post was edited

Not surprised. What scum.

The support notice got deleted[1]. The plugin developer got banned. Blocking access from certain ip. Shady or problematic hosting term[2]. I think hosting your code on wordpress.org is considered dangerous.

1. https://wordpress.org/support/topic/future-updates-for-acf-a...

2. https://github.com/wordpress/wporg-plugin-guidelines/blob/tr...

I wonder how many Automattic resources Matt threw at ACF to find a vulnerability to catalyze this situation?

Same, I was imagining Gavin Belsom and his warehouse full of Hooli employees scouring over the Pied Piper demo.

Similarly, this is all to resolve the personal grudge of an exceedingly rich dude who wants even more money.