CVE-2026-12995

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields.

• CWE-639

• https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L105
• https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3462
• https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3500
• https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L105
• https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3462
• https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3500
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3589466%40custom-field-template&new=3589466%40custom-field-template
• https://www.wordfence.com/threat-intel/vulnerabilities/id/02f44f5b-c513-4aba-b895-65df681620c6?source=cve

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1299The email module, specifically the "BytesGenerator" class, …6
• CVE-2026-12990An access control vulnerability in the mobile app (APK v5.5.…7.7
• CVE-2026-12991The lack of cryptographic mechanisms to ensure the integrity…8.7
• CVE-2026-12992A flaw was found in Apicurio Registry. The WSDLReaderAccesso…7.4
• CVE-2026-12993A flaw was found in Apicurio Registry. The DocumentBuilderAc…6.5
• CVE-2026-12994The WCFM – Frontend Manager for WooCommerce plugin for WordP…5.3
• CVE-2026-12996A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alp…8.1
• CVE-2026-12997The Gravity Forms plugin for WordPress is vulnerable to Dire…7.5
• CVE-2026-12998The Forminator Forms – Contact Form, Payment Form & Custom F…5.3
• CVE-2026-12999The Infineon Airoc Wi-Fi driver's transmit callback airoc_mg…5.3
• CVE-2026-1300The Responsive Header plugin for WordPress is vulnerable to …4.4
• CVE-2026-13001The Podlove Podcast Publisher plugin for WordPress is vulner…9.8