Executive brief
The Custom Field Template plugin for WordPress allows authenticated contributors to delete media files belonging to other users. An attacker with contributor-level access can manipulate form fields to target and remove any media attachment site-wide, causing broken pages and permanent content loss without authorization or logging.
Technical details
An insecure direct object reference (IDOR) vulnerability exists in the edit_meta_value function due to missing validation on user-controlled attachment IDs. Authenticated attackers with contributor-level access can craft requests with arbitrary numeric attachment IDs in the file-field parameter and a delete flag to remove media assets. Exploitation requires a Custom Field Template with at least one file-type field using the default configuration (mediaRemove option disabled).
Affected products
- Katsushika Tsutomu Custom Field Template up to and including 2.7.8
Timeline
- 2026-09-22: disclosed