Custom Field Template CVE-2026-12995

Requires an authenticated account with contributor-level access or above (PR:L). The attacker's post must be governed by a Custom Field Template that contains at least one file-type field whose mediaRemove option is NOT enabled - which is the DEFAULT configuration for file fields, so the precondition is commonly met rather than a rarely-used mode. Exploitation is network-reachable with no user interaction and low complexity: the attacker supplies any numeric attachment ID in the file-field parameter together with the delete flag. Limiting factors: the plugin must be installed and configured with such a template, the attacker must hold a valid low-privilege account, and impact is confined to deletion of media attachments (no data disclosure or code execution).

Moderate, well-bounded risk. The CVSS 4.3 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N correctly captures a network-reachable, low-complexity IDOR (CWE-639) requiring at least contributor-level authentication (PR:L) with no user interaction, and impact limited to integrity (I:L) - arbitrary media-attachment deletion - with no confidentiality (C:N) or formal availability (A:N) rating despite the practical content-loss/broken-page effect. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is no public exploit identified at time of analysis and not confirmed exploited. There is no SSVC decision record supplied. Signals are internally consistent: a Medium-severity, authenticated, destructive-but-not-catastrophic flaw is a routine-patch priority rather than an emergency. Note the input Tag 'Authentication Bypass' conflicts with the actual weakness - this is an authorization/IDOR issue (CWE-639), not an authentication bypass; the CVSS vector itself confirms authentication is REQUIRED (PR:L), so treat the tag as a mislabel, not evidence of pre-auth access.

A contributor-level user (e.g., a self-registered author or a compromised low-privilege account) creates or edits a post governed by a Custom Field Template that includes a default file-type field, then submits the file-field parameter with an arbitrary numeric attachment ID plus the delete flag. Because the handler never validates that the ID belongs to the attacker, the referenced media attachment - anywhere on the site, including images used by admin pages - is permanently deleted, causing broken pages site-wide. No public exploit code is identified, but the plugin source lines are cited in the references, lowering the barrier to reproduction.