Executive brief
The More Fields plugin for WordPress, which allows users to add custom data fields to their website posts, contains a security flaw that could allow an attacker to modify site settings. By tricking a logged-in administrator into visiting a malicious website, an attacker can silently add or delete custom fields and content boxes. This could lead to unauthorized changes in how website content is managed or displayed, potentially disrupting site operations.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress More Fields plugin version 2.1 due to the lack of validation for CSRF tokens in its administrative functions. The vulnerability is located within the options-general.php endpoint. An unauthenticated remote attacker can exploit this by crafting a malicious web page and tricking a logged-in administrator into interacting with it. Successful exploitation allows the attacker to perform unauthorized actions, specifically adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests. As development for this plugin has reportedly ceased, no official patch is available, and users are advised to switch to an alternative plugin.
Affected products
- WordPress More Fields 2.1
Timeline
- 2016-02-28: disclosed: Vulnerability discovered and exploit published by Aatif Shahdad
- 2026-06-15: advisory: CVE record published and enriched by VulnCheck