CVE-2026-12995

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9

Description The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in the edit meta value function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can delete arbitrary media attachments across the site by providing a numeric attachment ID in the file-field parameter along with a delete flag. This can lead to content loss and broken pages. This is possible when the attacker's post is managed by a template containing a file-type field where the mediaRemove option is disabled, which is the default setting.

Recommendations Update the plugin to a version newer than 2.7.8. As a temporary mitigation, restrict contributor-level access to posts governed by Custom Field Templates containing file-type fields.