CVE-2026-9855

Overview

The Custom Field Template plugin for WordPress contains a SQL injection vulnerability through the 'post_ID' parameter in versions up to and including 2.7.8. The flaw occurs due to insufficient escaping and a type-casting discrepancy in permission checks, allowing authenticated users to manipulate database queries.

Description

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The capability check via current_user_can('edit_post', $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink, and a valid nonce — which is also required — can be legitimately obtained by any Contributor-level user from the post edit screen.

Impact

Authenticated attackers with contributor-level access and above can exploit this vulnerability to append malicious SQL queries. This exposure allows unauthorized extraction of sensitive information from the underlying database. The confidentiality of stored data is compromised, while integrity and availability remain dependent on the nature of the injected queries.

Remediation

Update the Custom Field Template plugin to a version later than 2.7.8 once a vendor patch is available. As a temporary mitigation, restrict contributor-level access or disable the plugin if it is not business-critical. Continuously monitor database logs for abnormal query patterns originating from authenticated low-privilege accounts.

Risk context

This vulnerability is rated as medium severity with a CVSS v3 score of 6.5 and a low EPSS score of 0.00344. Exploitation requires authenticated access with at least contributor privileges and a valid nonce, reducing immediate external exposure but still requiring timely remediation.

Affected products

• Custom Field Template plugin for WordPress