Security Alert Summary
The Custom Field Template plugin for WordPress (all versions up to and including 2.7.8) contains an Insecure Direct Object Reference in the edit_meta_value handling of file-type fields. Authenticated users with contributor-level access or higher can trigger deletion of arbitrary media attachments by supplying a numeric attachment ID in the file-field parameter along with the corresponding delete flag, which can cause content loss and broken pages when affected media are removed.
CVE Details
- CVE ID:
CVE-2026-12995 - Affected component: Custom Field Template plugin for WordPress
- Affected versions: All versions up to and including 2.7.8
- Published: September 22, 2026 at 08:16:36 AM UTC
- Last modified: September 22, 2026 at 11:17:23 AM UTC
- CVSS v3.1 base score: 4.3 (MEDIUM)
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Attack requires an authenticated user with at least contributor-level privileges. Privileges required: LOW. User interaction: NONE.
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW (unauthorized deletion of media attachments)
- Availability: NONE
- Weakness (CWE): CWE-639
Technical Details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the plugin’s handling of file-type custom fields. The plugin fails to validate a user-controlled key when processing edit_meta_value, allowing an authenticated user to supply an arbitrary numeric attachment ID in the file-field parameter together with the delete flag. When the attacked post is governed by a Custom Field Template that includes at least one file-type field and the field’s mediaRemove option is not enabled (the default), the plugin will process the delete request and remove the specified media attachment site-wide.
Named elements from the report: the edit_meta_value handler, the file-field parameter, and the mediaRemove option. The root cause is missing validation of a user-controlled identifier, which permits manipulation of attachment deletion logic to target arbitrary numeric attachment IDs.
Impact is limited to unauthorized deletion of media (integrity impact). The vulnerability does not indicate escalation to full site compromise or disclosure of confidential data based on the provided information.
How This Could Impact Your Website
Consider a site with multiple roles: the site owner and administrators manage themes and plugins, internal staff publish content, and external contributors or contractors submit posts. If a contributor creates or edits a post using a Custom Field Template that includes a file-type field (with the default mediaRemove behavior), a malicious or compromised contributor account could delete media attachments used elsewhere on the site by supplying a crafted file-field value. This can lead to missing images or documents across multiple pages and posts, broken layout or functionality, and content loss that requires restoration from backups.
The primary consequence is integrity damage to site content (deleted media), which can harm user experience and require administrative effort to recover. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins.
- Monitor site activity and media library changes for unusual behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L105
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3462
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3500
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L105
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3462
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3500
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3589466%40custom-field-template&new=3589466%40custom-field-template
- https://www.wordfence.com/threat-intel/vulnerabilities/id/02f44f5b-c513-4aba-b895-65df681620c6?source=cve
