What is the CVSS score of CVE-2026-57687?

CVE-2026-57687 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Custom Field Template are affected by CVE-2026-57687?

A SQL injection vulnerability in the Custom Field Template WordPress plugin (versions ≤2.7.8) allows users with minimal site access to extract sensitive data including credentials and configuration…

How to fix or mitigate CVE-2026-57687?

24 hours: Audit all WordPress installations for Custom Field Template plugin versions ≤2.7.8; immediately disable or remove affected versions pending patch availability. 7 days: Restrict Contributor role permissions, implement database-level access controls, and audit user role assignments to minimize risk exposure. 30 days: Monitor Patchstack and WordPress Plugin Directory for vendor patch release; evaluate alternative field customization plugins if no patch emerges.

Custom Field Template CVE-2026-57687

EUVD-2026-41296 HIGH

SQL Injection (CWE-89)

2026-07-02 Patchstack

GHSA-3jm7-hr4j-gx2m

WordPress SQLi Custom Field Template Wordpress Plugin

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable SQLi requiring only Contributor auth (PR:L), no interaction; injection into the shared DB changes scope (S:C) with high data disclosure (C:H), no integrity, low availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:26 vuln.today

DescriptionCVE.org

Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.

AnalysisAI

SQL injection in the Custom Field Template WordPress plugin (versions <= 2.7.8) allows a low-privileged authenticated user at the Contributor role to inject arbitrary SQL into backend database queries. Because the CVSS scope is changed and confidentiality impact is High, a Contributor can read data beyond their own authorization boundary, including other users' credentials and site secrets. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no KEV listing.

Technical ContextAI

Custom Field Template is a WordPress plugin authored by Hiroaki Miyashita (CPE cpe:2.3:a:hiroaki_miyashita:custom_field_template) that adds configurable custom field forms to the post/page editor. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaching the plugin - plausibly through its custom field or template-handling parameters exposed to Contributor-capable users - is concatenated into a database query without adequate parameterization or escaping through WordPress's $wpdb->prepare()/sanitization layer. The changed scope (S:C) indicates the injection reaches the shared WordPress/MySQL database, letting a low-privileged plugin user affect the security-authority boundary of the whole site database rather than just plugin-local data.

RemediationAI

No vendor-released patch version is identified in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/custom-field-template/vulnerability/wordpress-custom-field-template-plugin-2-7-8-sql-injection-vulnerability) for the fixed release and upgrade to any version above 2.7.8 once published. Because exploitation requires a Contributor account, the most effective compensating control until patching is to restrict who holds Contributor (or higher, contributor-capable) roles: audit and remove untrusted contributor accounts and disable open user registration or lower the default new-user role to Subscriber, accepting the trade-off that legitimate self-service contributors will need manual approval. As a defense-in-depth measure, place a WAF/virtual patch in front of the site to block SQL-injection patterns targeting the plugin's parameters (Patchstack provides such virtual patching), noting this can produce false positives on legitimate custom-field content; if the plugin is not essential, deactivate and remove it entirely to eliminate exposure.