CVE-2026-12995 Overview
The Custom Field Template plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability affecting all versions up to and including 2.7.8. The flaw resides in the edit_meta_value functionality, which fails to validate a user-controlled key before performing media deletions. Authenticated attackers with contributor-level access or above can delete arbitrary media attachments across the entire site by supplying any numeric attachment ID in the file-field parameter together with the delete flag. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration.
Critical Impact
Low-privileged contributors can delete arbitrary media attachments site-wide, causing content loss and broken pages across the WordPress site.
Affected Products
- WordPress Custom Field Template plugin versions up to and including 2.7.8
- WordPress sites permitting contributor-level or above registration
- Sites using the default mediaRemove configuration on file-type fields
Discovery Timeline
- 2026-09-22 - CVE-2026-12995 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-12995
Vulnerability Analysis
The vulnerability is classified as an Insecure Direct Object Reference [CWE-639]. The edit_meta_value code path in custom-field-template.php accepts a numeric identifier from the request and uses it to locate and remove a media attachment. The plugin does not verify that the supplied attachment ID belongs to the requesting user or to the post being edited. Any authenticated user with contributor privileges can therefore reference any attachment ID on the site and trigger its deletion. The result is site-wide content loss, broken image references, and disrupted pages that rely on the deleted media.
Root Cause
The root cause is missing authorization on a user-controlled key. The plugin trusts the file-field parameter value without checking ownership, capability, or context. Access control decisions are made based on the presence of the delete flag rather than on whether the caller has rights to the target object. The affected logic is referenced at lines 105, 3462, and 3500 of custom-field-template.php in the 2.7.7 and 2.7.8 tags in the WordPress plugin repository.
Attack Vector
An authenticated contributor edits or submits a post that is bound to a Custom Field Template containing a file-type field with mediaRemove disabled. In the request, the attacker sets the file-field parameter to the numeric ID of any media attachment on the site and includes the corresponding delete flag. The plugin processes the request and removes the referenced attachment from the media library. No cross-site interaction is required, and the request originates over the network against the WordPress admin endpoint.
See the Wordfence vulnerability analysis for additional technical detail. No public proof-of-concept exploit code is available at this time.
Detection Methods for CVE-2026-12995
Indicators of Compromise
- Unexpected attachment post deletions in the WordPress activity log, particularly from users with the contributor role
- HTTP POST requests to post edit endpoints containing a file-field parameter with a numeric ID that does not match any file uploaded by the requesting user
- Sudden appearance of broken image links or missing media on published posts and pages
- Media library entries disappearing without a corresponding action by an administrator or editor
Detection Strategies
- Enable WordPress audit logging to capture attachment deletion events and correlate them with the acting user role and source IP
- Monitor web server access logs for POST requests to post.php or admin-ajax.php that include the file-field and delete parameters from contributor accounts
- Compare current attachment IDs against periodic media library snapshots to identify unexpected deletions
Monitoring Recommendations
- Alert on any attachment deletion performed by an account with a role lower than editor
- Track the frequency of edits to posts governed by Custom Field Templates that expose file-type fields
- Review contributor account creation patterns for anomalies, particularly on sites that allow open registration
How to Mitigate CVE-2026-12995
Immediate Actions Required
- Update the Custom Field Template plugin to a version later than 2.7.8 that includes the fix from WordPress changeset 3589466
- Audit existing Custom Field Templates and enable the mediaRemove option on file-type fields where possible
- Review contributor and author accounts and remove any that are unused or unrecognized
Patch Information
The vendor addressed the vulnerability in the code committed under changeset 3589466 in the WordPress plugin repository. Site administrators should upgrade to the patched release available through the WordPress plugin directory. Verify the installed version through the WordPress admin plugins page after applying the update.
Workarounds
- Restrict Custom Field Template usage to posts editable only by editors or administrators until the patch can be applied
- Enable the mediaRemove option on every file-type field defined in Custom Field Templates to block the deletion code path
- Temporarily disable the Custom Field Template plugin on sites that cannot upgrade immediately and rely on contributor-level authors
- Deploy a web application firewall rule that blocks POST requests containing a file-field parameter combined with the delete flag when submitted by low-privileged users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.