Custom Fields
Monthly
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.