CVE Catalog
CVE-2026-16940
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk0.17%
6th percentile - higher than 6% of all known CVEs
Summary
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.
Risk Assessment
The risk is critical because an unauthenticated attacker can delete key files, potentially leading to full site takeover.
Recommendation
Update the Custom Fields plugin to version 1.5.1 or later immediately.
Original NVD description (English source)
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.