CVE-2026-9855: WordPress Custom Field Template SQL Injection

CVE-2026-9855 Overview

The Custom Field Template plugin for WordPress contains an authenticated SQL injection vulnerability in the post_ID parameter. The flaw affects all versions up to and including 2.7.8. Insufficient escaping of user-supplied input, combined with an SQL query that lacks proper preparation, allows authenticated attackers with Contributor-level access to append arbitrary SQL statements to existing queries. Successful exploitation exposes sensitive information stored in the WordPress database, including password hashes, session tokens, and private post content. The vulnerability is classified under CWE-89: SQL Injection.

Critical Impact
Authenticated Contributor-level users can extract sensitive data from the WordPress database, including credentials and secrets, by injecting SQL through the post_ID parameter.

Affected Products

Custom Field Template plugin for WordPress, versions up to and including 2.7.8
WordPress sites using the plugin with Contributor-level users or higher
All deployments where the vulnerable post_ID handler in custom-field-template.php is reachable

Discovery Timeline

2026-09-19 - CVE-2026-9855 published to the National Vulnerability Database
2026-09-21 - Last updated in the NVD database

Technical Details for CVE-2026-9855

Vulnerability Analysis

The vulnerability resides in the Custom Field Template plugin's handling of the post_ID request parameter. The plugin passes the raw parameter value into an SQL query without adequate escaping or use of prepared statements. An authenticated attacker with Contributor privileges can append additional SQL clauses to the existing query and exfiltrate data from any table in the WordPress database.

The plugin attempts to gate access with a current_user_can('edit_post', $id) capability check and a nonce requirement. Both controls are bypassable in practice. WordPress internally casts $id to an integer during permission evaluation, while the original unsanitized string is preserved and forwarded to the SQL sink. Any Contributor can also legitimately obtain a valid nonce from the post edit screen, satisfying the second control.

Root Cause

The root cause is a combination of insufficient input sanitization and an unprepared SQL query construction pattern. The post_ID parameter reaches the query builder without being cast, quoted, or bound as a parameter. Compounding this, the authorization check operates on a coerced integer representation of the identifier, while the SQL sink consumes the raw string. This inconsistency creates a Time-of-Check/Time-of-Use mismatch between authorization and data handling.

Attack Vector

Exploitation requires an authenticated session with Contributor-level access or higher, which many WordPress deployments permit through open registration or invited authoring workflows. The attacker submits a crafted post_ID value combining a valid numeric identifier with appended SQL syntax. Because WordPress casts the value to an integer for the capability check, the malicious suffix is ignored during authorization but preserved when the string is concatenated into the vulnerable query. The attack requires no user interaction beyond the attacker's own authenticated request. See the Wordfence Vulnerability Report and the referenced code locations in the WordPress Plugin Repository for the vulnerable sinks at lines 105, 3353, 3479, and 4442.

Detection Methods for CVE-2026-9855

Indicators of Compromise

Web server access logs containing post_ID parameter values that include SQL syntax such as UNION, SELECT, SLEEP(, comment markers, or single quotes
Unexpected outbound queries against wp_users, wp_usermeta, or wp_options tables originating from plugin request handlers
Contributor accounts issuing requests to admin-ajax or post-edit endpoints at unusual frequency
Database error entries referencing the Custom Field Template plugin file paths

Detection Strategies

Deploy web application firewall rules that inspect the post_ID parameter for non-numeric characters and block requests that fail integer validation
Enable MySQL general query logging or slow query logging on WordPress databases to capture anomalous query structures
Correlate authenticated Contributor session activity with database read volume to identify enumeration patterns

Monitoring Recommendations

Alert on any HTTP request where post_ID contains characters outside the digit set
Monitor for repeated 200-response requests to plugin endpoints from newly registered or low-privilege accounts
Track query latency spikes and error rates on the WordPress database as potential indicators of blind SQL injection probing

How to Mitigate CVE-2026-9855

Immediate Actions Required

Update the Custom Field Template plugin to the patched release published after version 2.7.8 as soon as it becomes available
Audit all Contributor-level and higher accounts and disable any that are unused or unrecognized
Rotate WordPress secret keys, administrator passwords, and API tokens if exploitation is suspected
Review the WordPress Custom Field Template Changeset to confirm the patched version deployed

Patch Information

The vendor has published a changeset addressing the vulnerable query sinks in custom-field-template.php. Site administrators should apply the fixed version through the WordPress plugin update mechanism and validate the plugin file hashes match the official release. Refer to the WordPress Custom Field Template repository for the current source and version history.

Workarounds

Deactivate the Custom Field Template plugin until a patched release is installed on the site
Restrict Contributor account creation and require administrator approval for new author-level registrations
Add a WAF signature that rejects any request where the post_ID parameter fails a strict integer regex such as ^[0-9]+$
Apply the principle of least privilege by demoting non-essential Contributor accounts to Subscriber where authoring is not required

bash

# Example ModSecurity rule to enforce integer-only post_ID values
SecRule ARGS:post_ID "!@rx ^[0-9]+$" \
  "id:1029855,phase:2,deny,status:403,\
   msg:'CVE-2026-9855 - Non-integer post_ID blocked',\
   tag:'sqli',tag:'wordpress',tag:'custom-field-template'"