EUVD-2026-53110
GHSA-m93v-54x2-539c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify site running Custom Fields plugin
-
DeliverySend crafted deletion request with traversal path
-
ExploitBypass missing path validation
-
InstallDelete wp-config.php
-
C2Trigger WordPress reinstall wizard
-
ExecuteReconfigure to attacker database
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Custom Fields WordPress plugin (versions below 1.5.1). The only prerequisites are that the plugin is installed and active and that the web server process has write/delete permission on the target file (which it normally does for wp-config.php in a standard WordPress install). Exploitation requires no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L); the practical limiting factor is simply whether the site runs this specific, relatively niche plugin. |
| Impact | The signals are mixed but lean toward high priority for any site running this plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C, base 10.0) describes trivially reachable, unauthenticated, scope-changing exploitation, and SSVC agrees the technical impact is 'total' and the attack is 'automatable: yes' - meaning it can be scripted at scale. Publicly available exploit code lowers the barrier further. Counterbalancing this, EPSS is only 0.17% (6th percentile) and SSVC exploitation status is 'none' (no observed active exploitation), and the flaw is not in CISA KEV - so despite the perfect CVSS and available POC, there is no evidence of widespread real-world attacks yet. The low EPSS most likely reflects the limited deployment footprint of this specific plugin rather than any difficulty of exploitation. Note that CVSS scores confidentiality impact as none (C:N) while impact is driven entirely by integrity and availability (file deletion), which is consistent with the described behavior. |
| Exploit ScenarioDerived | An attacker sends a single crafted, unauthenticated HTTP request to the vulnerable plugin endpoint with a traversal path such as '../../wp-config.php' as the file to delete. With wp-config.php gone, the attacker loads the site, is presented with the WordPress installation wizard, and reconfigures it against a database they control - obtaining full administrative access. Publicly available exploit code makes this scriptable against many sites at once. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade the Custom Fields plugin to version 1.5.1 or later, which adds validation of the user-supplied file path before deletion. If immediate patching is not possible, restrict or block access to the plugin's file-deletion endpoint at the web server or WAF layer (for example, deny unauthenticated POST requests to the vulnerable plugin handler) and consider deactivating the plugin entirely until it is updated - the trade-off being loss of any custom-field functionality it provides. As a defense-in-depth measure, ensure the web server user has least-privilege filesystem permissions and back up wp-config.php and the database so a deletion-based takeover can be reversed. Consult the WPScan advisory (https://wpscan.com/vulnerability/a315a6ac-3ffb-4735-92ca-6e85338f8807/) for exploitation specifics.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic path traversal (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in a PHP-based WordPress plugin. The plugin exposes a file-deletion routine that accepts a user-controlled file path and passes it to a delete operation without canonicalization or restriction to an allowed directory, so sequences like '../' let the caller escape the intended location and reach sensitive files anywhere the web server user can write. In WordPress, deleting wp-config.php is particularly damaging: WordPress treats a missing configuration file as a fresh install and re-enters the setup wizard, letting an attacker point the site at an attacker-controlled database and seize administrative control. The CPE (cpe:2.3:a:unknown:custom_fields) is generic and does not identify a specific vendor, but the WPScan advisory and 'Custom Fields' plugin slug pin the affected component.
Know when Custom Fields gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Unauthenticated remote file deletion (PR:N/UI:N/AV:N/AC:L); deleting wp-config.php escapes the plugin to compromise the whole site (S:C) with no data disclosure (C:N) but full integrity/availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.
Executive ViewAI
The Custom Fields WordPress plugin (versions before 1.5.1) contains a critical flaw allowing unauthenticated attackers to delete arbitrary files, including site configuration files, via publicly available exploit code. Any WordPress site using this plugin is vulnerable to complete infrastructure compromise and service outage. Organizations must immediately patch or disable the plugin across all WordPress deployments to prevent catastrophic site takeover.
Apply vendor patch: Custom Fields WordPress plugin version 1.5.1 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB