Benutzerdefinierte Felder zu Medien <= 2.0.3 hinzufügen - Cross-Site Request Forgery zur benutzerdefinierten Felddurchlöschung über den 'delete'-Parameter
Plattform
wordpress
Komponente
add-custom-fields-to-media
Behoben in
2.0.4
CVE-2026-4068 represents a Cross-Site Request Forgery (XSRF) vulnerability affecting the Add Custom Fields to Media plugin for WordPress. This flaw allows unauthenticated attackers to delete custom media fields by crafting malicious requests. The vulnerability impacts versions from 0.0.0 through 2.0.3. A patch is available in version 2.0.4.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Auswirkungen und Angriffsszenarien
An attacker can exploit this XSRF vulnerability to delete arbitrary custom media fields within a WordPress site. This could disrupt workflows, remove important metadata associated with media files, and potentially lead to data loss. While the direct impact might seem limited, the ability to modify site configuration through forged requests can be a stepping stone for further attacks, especially if custom fields are integral to site functionality. The lack of nonce validation on the deletion functionality makes this vulnerability relatively easy to exploit.
Ausnutzungskontext
This vulnerability was publicly disclosed on 2026-03-19. While no active exploitation campaigns have been publicly reported, the ease of exploitation and the plugin's popularity suggest a potential for opportunistic attacks. No Proof of Concept (PoC) code has been publicly released, but the vulnerability is straightforward to exploit given the missing nonce validation. It is not currently listed on the CISA KEV catalog.
Bedrohungsanalyse
Exploit-Status
EPSS
0.02% (3% Perzentil)
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Keine — ohne Authentifizierung ausnutzbar. Keine Zugangsdaten erforderlich.
- User Interaction
- Erforderlich — Opfer muss eine Datei öffnen, auf einen Link klicken oder eine Seite besuchen.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Niedrig — Angreifer kann einige Daten mit begrenztem Umfang ändern.
- Availability
- Keine — kein Verfügbarkeitseinfluss.
Betroffene Software
Paketinformationen
- Aktive Installationen
- 90
- Plugin-Bewertung
- 5.0
- Erfordert WordPress
- 5.2+
- Kompatibel bis
- 6.9.4
- Erfordert PHP
- 7.2+
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
- Geändert
- EPSS aktualisiert
Mitigation und Workarounds
The primary mitigation for CVE-2026-4068 is to immediately upgrade the Add Custom Fields to Media plugin to version 2.0.4 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out requests containing the 'delete' parameter in the GET request without proper authentication. Additionally, restrict access to the plugin's admin pages to authorized users only. After upgrading, confirm the fix by attempting to delete a custom media field via a crafted XSRF request – it should be rejected.
So beheben
Aktualisieren Sie auf Version 2.0.4 oder eine neuere gepatchte Version
CVE-Sicherheitsnewsletter
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
Häufig gestellte Fragenwird übersetzt…
What is CVE-2026-4068 in Add Custom Fields to Media?
It's a Cross-Site Request Forgery (XSRF) vulnerability in the Add Custom Fields to Media WordPress plugin, allowing attackers to delete custom media fields.
Am I affected by CVE-2026-4068 in Add Custom Fields to Media?
If you're using the Add Custom Fields to Media plugin in versions 0.0.0 through 2.0.3, you are potentially affected by this vulnerability.
How do I fix CVE-2026-4068 in Add Custom Fields to Media?
Upgrade the plugin to version 2.0.4 or later to resolve the XSRF vulnerability. Consider WAF rules as a temporary workaround.
Is CVE-2026-4068 being actively exploited?
There are currently no reports of active exploitation campaigns targeting CVE-2026-4068, but the ease of exploitation warrants caution.
Where can I find the official Add Custom Fields to Media advisory for CVE-2026-4068?
Refer to the official WordPress security advisories and the Add Custom Fields to Media plugin developer's website for more information.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.