SQL Injection Vulnerability in Custom Field Template Plugin for WordPress

CVE-2026-9855

What is CVE-2026-9855?

The Custom Field Template plugin for WordPress is susceptible to SQL Injection via the 'post_ID' parameter in all versions up to and including 2.7.8. This vulnerability arises from inadequate escaping of user-supplied input and poor preparation of the SQL query. Authenticated users with contributor-level access and above can exploit this flaw to inject additional SQL commands, potentially leading to sensitive data exposure from the database. The permission check, which uses current_user_can('edit_post', $id), can be bypassed as WordPress treats $id as an integer during permission verification, allowing the unescaped string to be passed directly to the SQL execution point. A valid nonce, necessary for operations, can be acquired by any contributor from the post edit interface, further enabling the attack.

References