Security Alert Summary
The Custom Field Template plugin for WordPress has a reported SQL injection vulnerability affecting all versions up to and including 2.7.8. Authenticated users with Contributor-level access or higher can supply a crafted post_ID parameter that is not sufficiently escaped, allowing additional SQL to be appended to existing queries and potentially exposing sensitive database information.
CVE Details
- CVE ID: CVE-2026-9855
- Affected component: Custom Field Template plugin (vendor: hiroaki-miyashita)
- Affected versions: All versions up to and including 2.7.8
- Published: September 19, 2026 at 08:16:55 AM UTC
- Last modified: September 19, 2026 at 02:17:07 PM UTC
- CVSS v3.1: Base Score 6.5, Severity MEDIUM, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Authentication required: Yes – authenticated users
- Privileges required: Low (Contributor-level or above)
- User interaction: None
- Primary impact:
- Confidentiality: HIGH
- Integrity: NONE
- Availability: NONE
- Weakness: CWE-89 (SQL Injection)
Technical Details
The vulnerability is a generic SQL injection in the plugin’s handling of the post_ID parameter. The plugin fails to sufficiently escape or prepare user-supplied input before it is incorporated into an SQL query, allowing an authenticated attacker to append additional SQL fragments to existing queries.
The built-in capability check uses current_user_can('edit_post', $id), but this check is bypassable in this case because WordPress casts $id to an integer for the permission evaluation while the full unsanitized string remains preserved and is passed to the SQL sink. A valid nonce is also required by the plugin, and according to the report a Contributor-level user can legitimately obtain such a nonce from the post edit screen. These factors permit a Contributor to supply input that reaches the database layer without adequate sanitization.
Impact is limited to unauthorized disclosure of data via crafted SQL. The vulnerability does not, according to the provided data, indicate direct modification or deletion of data or a denial of service, but it does allow extraction of sensitive information from the database when exploited.
How This Could Impact Your Website
Consider a site with multiple user roles: a site owner, internal staff with Editor access, and external contributors who submit content. A contributor who has access to the post edit screen could use the vulnerable parameter to extract database information beyond their intended permissions. In practice this could lead to exposure of internal user email addresses or other confidential records stored in the database, increasing the risk of targeted phishing or social engineering against staff and administrators.
The issue is primarily a confidentiality risk consistent with the CVSS data. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially Contributor-level access.
- Enforce strong passwords and enable two-factor authentication for Editors and Administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site and database activity for unusual queries or access patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L105
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3353
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3479
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L4442
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L105
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3353
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3479
- https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L4442
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3589466%40custom-field-template&new=3589466%40custom-field-template
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ce924708-935a-45c0-8959-dd122632cef4?source=cve
