CVE-2026-9855

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9

Description Authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs because the post ID parameter is not sufficiently escaped and the SQL query is not properly prepared. The issue is exacerbated by a bypass in the current user can('edit post', $id) function, where WordPress casts $id to an integer for permission checks but passes the full unsanitized string to the SQL sink. This allows attackers to append additional SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 2.7.8. Avoid using the post ID parameter in the affected plugin until the update is applied.