CVE-2026-4068: XSRF in Add Custom Fields to Media WordPress Plugin

An attacker can exploit this XSRF vulnerability to delete arbitrary custom media fields within a WordPress site using the vulnerable plugin. This could disrupt workflows that rely on these custom fields, potentially leading to data loss or operational issues. While the direct impact might seem limited to field deletion, it can be a component of a broader attack. For example, if these custom fields store sensitive information, their deletion could be a step towards data exfiltration or denial of service. The blast radius is limited to sites using the Add Custom Fields to Media plugin, but the ease of exploitation makes it a concerning risk, particularly for sites with many custom fields.

1. Reserved2026-03-12
2. Published2026-03-19
3. Modified2026-04-08
4. EPSS updated2026-03-26

The primary mitigation for CVE-2026-4068 is to upgrade the Add Custom Fields to Media plugin to version 2.0.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting access to the plugin's admin interface to trusted users only, or using a Web Application Firewall (WAF) to filter out potentially malicious requests targeting the field deletion endpoint. WAF rules should specifically look for requests with the 'delete' parameter in the GET request without proper nonce validation. After upgrading, verify the fix by attempting to delete a custom field via a crafted URL; the request should be rejected.

Active installs

90

Plugin rating