CVE-2026-12995: Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields.
Affected Software
Event History
Frequently Asked Questions
Which sites and users are exposed to exploitation?
A site is exposed where a contributor or higher-privileged user can edit a post governed by a Custom Field Template that includes a file-type field. The file field must have mediaRemove disabled, which is the default configuration.
What does an attacker need to do to exploit this issue?
The attacker needs an authenticated WordPress account with contributor-level access or greater and access to an affected post. They can supply a numeric media attachment ID through the file_field parameter with the corresponding delete flag to delete that attachment.
What is the impact of successful exploitation?
An attacker can delete arbitrary media attachments across the site, not only attachments associated with their own post. This can cause content loss and break pages that reference the deleted media.
What can be changed if updating is not immediately possible?
For file-type fields in Custom Field Templates, enable the mediaRemove option. The described exploitation condition requires mediaRemove to be disabled.