What is the CVSS score of CVE-2026-4068?

CVE-2026-4068 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4068?

Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in all should be aware of moderate risk from CVE-2026-4068, a cross-site request forgery vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-4068?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery in and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WordPress CVE-2026-4068

EUVD-2026-13070 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-19 Wordfence

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 07:15 euvd

EUVD-2026-13070

Analysis Generated

Mar 19, 2026 - 07:15 vuln.today

CVE Published

Mar 19, 2026 - 06:46 nvd

MEDIUM 4.3

DescriptionCVE.org

The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (line 24-36), but the 'delete field' operation (lines 38-49) processes the $_GET['delete'] parameter and calls update_option() without any nonce verification. This makes it possible for unauthenticated attackers to delete arbitrary custom media fields via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Add Custom Fields to Media WordPress plugin versions up to 2.0.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the field deletion functionality that allows unauthenticated attackers to delete arbitrary custom media fields. The vulnerability exists because the plugin validates nonces for the 'add field' operation but fails to validate nonces on the 'delete field' operation, which processes the $_GET['delete'] parameter directly. An attacker can exploit this by tricking a site administrator into clicking a malicious link, resulting in unauthorized deletion of custom media field configurations with no authentication required beyond social engineering.

Technical ContextAI

The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a class of attack that exploits the trust a web application places in authenticated user sessions. The Add Custom Fields to Media plugin (cpe:2.3:a:pattihis:add_custom_fields_to_media:*:*:*:*:*:*:*:*) is a WordPress plugin that extends WordPress media functionality by allowing administrators to define custom fields for media attachments. The plugin's admin display template (add-custom-fields-to-media-admin-display.php) contains inconsistent nonce validation: lines 24-36 properly implement nonce checking for field additions using wp_verify_nonce(), but lines 38-49 handle field deletion without any nonce validation, directly reading and processing the $_GET['delete'] parameter before calling WordPress's update_option() function. This inconsistency creates a CSRF window where an attacker-controlled request can modify WordPress options without the administrator's knowledge or consent.

RemediationAI

Site administrators must immediately upgrade the Add Custom Fields to Media plugin to a version newer than 2.0.3, which includes nonce validation for the delete field operation (verify availability through the WordPress plugin repository or vendor website). Until patching is available or feasible, implement WordPress security headers and Content Security Policy (CSP) to mitigate CSRF attacks, restrict admin dashboard access to known IP ranges via web application firewall rules, and educate site administrators about not clicking links in untrusted emails or messages that reference the WordPress dashboard. Consider disabling the plugin entirely if custom media fields are not actively used. Site administrators should check the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/add-custom-fields-to-media/ for patch availability and follow the changeset updates referenced in security advisories.