Custom Post Type <= 1.0 - カスタム投稿タイプの削除におけるクロスサイトリクエストフォージェリ

The primary impact of this CSRF vulnerability is the unauthorized deletion of custom post types. An attacker could craft a malicious link or embed a hidden form on a website that, when visited by an administrator, triggers the deletion of custom post types. This can lead to data loss, broken site functionality, and a degraded user experience. While direct data exfiltration isn't possible through this vulnerability, it could be chained with other attacks to gain further access or control over the WordPress site. The blast radius is limited to the specific WordPress instance running the vulnerable plugin and its associated custom post types.

WordPress sites utilizing the Custom Post Type plugin are at risk, particularly those with shared hosting environments or where administrator access is not strictly controlled. Sites relying heavily on custom post types for core functionality are also at higher risk, as the deletion of these post types could significantly disrupt site operations.

• wordpress / composer / npm:

grep -r "wp_delete_custom_post_type" /var/www/html/wp-content/plugins/custom-post-type/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=custom_post_type_delete&post_type=your_custom_post_type | grep -i '200 ok'

1. 2025-11-21Disclosure

   disclosure

1. 予約済み2025-11-13
2. 公開日2025-11-21
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

Until a patched version of the Custom Post Type plugin is released, several mitigation steps can be taken. First, restrict access to the WordPress admin panel to only authorized personnel. Implement strict URL filtering on your web server to block suspicious requests. Consider using a WordPress security plugin with CSRF protection features. Additionally, carefully review any links or forms received via email or other channels before clicking or submitting them. After a patched version is available, upgrade the plugin immediately and verify that custom post types are intact by listing them within the WordPress admin interface.