EUVD-2026-13070Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (line 24-36), but the 'delete field' operation (lines 38-49) processes the $_GET['delete'] parameter and calls update_option() without any nonce verification. This makes it possible for unauthenticated attackers to delete arbitrary custom media fields via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Add Custom Fields to Media WordPress plugin versions up to 2.0.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the field deletion functionality that allows unauthenticated attackers to delete arbitrary custom media fields. The vulnerability exists because the plugin validates nonces for the 'add field' operation but fails to validate nonces on the 'delete field' operation, which processes the $_GET['delete'] parameter directly. An attacker can exploit this by tricking a site administrator into clicking a malicious link, resulting in unauthorized deletion of custom media field configurations with no authentication required beyond social engineering.
Technical ContextAI
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a class of attack that exploits the trust a web application places in authenticated user sessions. The Add Custom Fields to Media plugin (cpe:2.3:a:pattihis:add_custom_fields_to_media:*:*:*:*:*:*:*:*) is a WordPress plugin that extends WordPress media functionality by allowing administrators to define custom fields for media attachments. The plugin's admin display template (add-custom-fields-to-media-admin-display.php) contains inconsistent nonce validation: lines 24-36 properly implement nonce checking for field additions using wp_verify_nonce(), but lines 38-49 handle field deletion without any nonce validation, directly reading and processing the $_GET['delete'] parameter before calling WordPress's update_option() function. This inconsistency creates a CSRF window where an attacker-controlled request can modify WordPress options without the administrator's knowledge or consent.
RemediationAI
Site administrators must immediately upgrade the Add Custom Fields to Media plugin to a version newer than 2.0.3, which includes nonce validation for the delete field operation (verify availability through the WordPress plugin repository or vendor website). Until patching is available or feasible, implement WordPress security headers and Content Security Policy (CSP) to mitigate CSRF attacks, restrict admin dashboard access to known IP ranges via web application firewall rules, and educate site administrators about not clicking links in untrusted emails or messages that reference the WordPress dashboard. Consider disabling the plugin entirely if custom media fields are not actively used. Site administrators should check the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/add-custom-fields-to-media/ for patch availability and follow the changeset updates referenced in security advisories.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today