CVE-2026-16940 Overview
CVE-2026-16940 is an unauthenticated arbitrary file deletion vulnerability in the Custom Fields WordPress plugin before version 1.5.1. The plugin fails to validate a user-supplied file path before invoking a delete operation. Unauthenticated attackers can send crafted requests to remove arbitrary files on the underlying server, including wp-config.php. Deleting wp-config.php triggers the WordPress setup routine, allowing attackers to connect the site to an attacker-controlled database and achieve full site takeover.
Critical Impact
Unauthenticated remote attackers can delete arbitrary server files and hijack the WordPress installation, resulting in full site compromise.
Affected Products
- Custom Fields WordPress plugin versions prior to 1.5.1
Discovery Timeline
- 2026-08-05 - CVE-2026-16940 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-16940
Vulnerability Analysis
The vulnerability is an unauthenticated arbitrary file deletion issue rooted in missing input validation. The Custom Fields plugin exposes a file deletion routine that accepts a file path from the HTTP request. The routine does not authenticate the caller, does not enforce a capability check, and does not constrain the path to an allowlisted directory.
Because the path is passed directly to a filesystem delete call, an attacker can supply traversal sequences or absolute paths that reference sensitive WordPress files. The most impactful target is wp-config.php. Removing that file causes WordPress to fall back to the installation wizard on the next request. An attacker who reaches the wizard first supplies their own database credentials, gains administrator access, and can then install malicious plugins or shells.
The EPSS probability for CVE-2026-16940 is 0.167%, reflecting current observed exploitation likelihood rather than technical severity.
Root Cause
The root cause is improper input validation of a user-controlled file path combined with a missing authorization check on the endpoint. The handler trusts request data and calls a delete function without confirming the target resides inside an intended directory.
Attack Vector
An unauthenticated attacker sends an HTTP request to the vulnerable plugin endpoint on a target WordPress site. The request supplies a path parameter pointing to wp-config.php or another sensitive file. The plugin deletes the target file. The attacker then loads the site homepage, is redirected to the WordPress installer, and reconfigures the site under attacker control. For technical specifics, see the WPScan Vulnerability Report.
Detection Methods for CVE-2026-16940
Indicators of Compromise
- Unexpected absence of wp-config.php or other core WordPress files on the web root.
- HTTP access log entries invoking Custom Fields plugin endpoints with path, file, or traversal sequences such as ../ in query strings.
- Sudden redirection of site visitors to /wp-admin/install.php.
- New administrator accounts or unfamiliar database connection settings following an outage.
Detection Strategies
- Monitor web server access logs for unauthenticated POST or GET requests to plugin AJAX or REST endpoints exposed by custom-fields.
- Alert on file system delete events targeting wp-config.php, .htaccess, or files under wp-includes/.
- Use file integrity monitoring to flag removal or modification of core WordPress files.
Monitoring Recommendations
- Forward web server, PHP-FPM, and WordPress audit logs to a centralized log platform for correlation.
- Baseline normal request patterns to Custom Fields endpoints and alert on unauthenticated calls that reference filesystem paths.
- Enable alerting on transitions of the site into the WordPress installation state.
How to Mitigate CVE-2026-16940
Immediate Actions Required
- Update the Custom Fields WordPress plugin to version 1.5.1 or later on all affected sites.
- Verify that wp-config.php and other core files are present and unmodified.
- Rotate WordPress database credentials, secret keys, and administrator passwords if compromise is suspected.
- Review installed plugins, themes, and user accounts for unauthorized additions.
Patch Information
The vendor addressed the vulnerability in Custom Fields version 1.5.1 by validating the supplied file path and restricting deletion to intended files. Site operators should apply the update through the WordPress plugin manager or via WP-CLI. Details are available in the WPScan Vulnerability Report.
Workarounds
- Deactivate and remove the Custom Fields plugin until the patched version is installed.
- Block requests to the vulnerable plugin endpoints at the web application firewall until patching completes.
- Restrict filesystem write and delete permissions on wp-config.php at the operating system level where feasible.
# Configuration example: update the plugin via WP-CLI
wp plugin update custom-fields --version=1.5.1
wp plugin list --name=custom-fields --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
