Cross-Site Request Forgery Vulnerability in Add Custom Fields to Media Plugin by WordPress

CVE-2026-4068

What is CVE-2026-4068?

The Add Custom Fields to Media plugin for WordPress has a serious Cross-Site Request Forgery vulnerability due to the absence of nonce validation in the field deletion process. This oversight allows an unauthenticated attacker to exploit the plugin and delete custom media fields by sending a crafted request. While nonce validation is implemented for adding fields, the deletion functionality does not perform necessary checks. As a result, if a site administrator unknowingly clicks on a malicious link, the attacker can manipulate the system without any form of authentication, leading to potential data loss and site integrity issues.

References