Custom field finder

Custom field finder has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (100%).

The one issue recorded for Custom field finder has a vendor fix available, so running the current release closes it.

All of these findings were reported by CatFather. Custom field finder is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh

8.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Custom field finder vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-33641

Custom field finder <= 0.3 - Authenticated (Author+) PHP Object Injection

Read the full analysis

Vulnerability Records

1 records


2024-04-25 00:00	Custom field finder <= 0.3 - Authenticated (Author+) PHP Object Injection Custom field finder <= 0.3	`CVE-2024-33641`	8.8 High	CatFather	Yes

Showing 1–1 of 1 reports

Latestv0.4

Custom field finder

Author

Yoast

5.0(5)

100/100

Last Updated

2026-08-18 (25d ago)

Active Installs

2,000+

Downloads

25,782

Requires WP

6.7+

Requires PHP

Tested up to

WP 7.1

Created

2013-04-18 (14y ago)

Allows you to easily find the custom fields (including hidden custom fields) and their values for a post, page or custom post type post. Just go to Tools – Custom field finder, enter the post ID of any post and you’ll see all the custom fields. This includes the custom fields that start with an underscore ( _ ) that are normally hidden from the custom fields interface.

View on WordPress.org