Executive brief
Simple Fields is a WordPress plugin used to add custom data fields to posts and pages. A security flaw in older versions allows an unauthenticated attacker to access sensitive system files or potentially take control of the web server. This vulnerability specifically affects websites running on outdated versions of PHP (older than 5.3.4).
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Simple Fields WordPress plugin (versions 0.2 - 0.3.5) due to improper sanitization of the 'wp_abspath' parameter in simple_fields.php. On PHP versions prior to 5.3.4, an unauthenticated attacker can use null byte injection (%00) to bypass file extension checks and include arbitrary local files, such as /etc/passwd. If 'allow_url_include' is enabled in the PHP configuration, or if an attacker can poison log files, this can be escalated to Remote Code Execution (RCE). The issue was addressed in version 0.3.6 by commenting out the vulnerable code, though the plugin is now end-of-life.
Affected products
- Simple Fields Simple Fields 0.2 through 0.3.5
Timeline
- 2011-02-03: patched: Vulnerability fixed in version 0.3.6
- 2018-04-08: disclosed: Public exploit published by Graeme Robinson
- 2026-05-17: advisory: CVE published/updated in NVD