Vulnerability found in Custom Field Suite

The plugin called Custom Field Suite for WordPress has a security issue that allows attackers to inject harmful code into the system. This can happen in all versions of the plugin, including version 2.6.7, through a custom field feature called Loop. This is because the plugin does not properly clean the input before using it in a function called eval(). This means that attackers who have contributor-level or higher access can run any PHP code they want on the server.