External risk intelligence

Custom Fields WordPress Plugin Arbitrary File Deletion Leads to Site Takeover

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-16940

This vulnerability affects a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, making plugins installed on these sites directly reachable via the internet as part of the standard web server request processing flow.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Custom Fields WordPress plugin that allows unauthenticated users to delete essential server files, potentially leading to a complete website compromise.

Allows deleting any file on the server.
Enables attackers to take over entire websites.
Confirm relevance and assess exposure to this plugin.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging the Custom Fields WordPress plugin's inability to properly check file paths before deletion. This could allow them to remove critical files from the server, potentially leading to a complete website compromise.

No authentication required.
Deleting arbitrary files on the server.
Complete site takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated user to delete arbitrary files on the server. When supported by the advisory, this could affect the integrity and availability of the WordPress site.

Site files, including configuration.
Unauthenticated users can delete files.
Site takeover and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Custom Fields WordPress plugin's arbitrary file deletion vulnerability requires immediate attention, impacting any site using the plugin. The primary action is to identify all instances of the affected plugin, confirm their exposure and business criticality, and then determine the responsible team for remediation. This could involve application owners, infrastructure teams, or the vendor-management team if the plugin was acquired through a third party, to plan coordinated mitigation based on the assessed risk.

WordPress site owners and platform teams.
Verify plugin presence and site criticality.
Plan targeted removal or upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Custom Fields WordPress plugin?

The Custom Fields plugin is an add-on for WordPress websites that allows administrators to define and display additional metadata or specific content fields beyond the default posts and pages functionality. It is commonly used to extend a site's data structure, enabling more complex content layouts and tailored information management without requiring custom code development.

How does CWE-22 relate to CVE-2026-16940?

CVE-2026-16940 is categorized under CWE-22, which stands for Improper Limitation of a Pathname to a Restricted Directory, often called Path Traversal. In this specific case, the software fails to properly sanitize user input, allowing an attacker to manipulate file paths. This flaw gives the plugin the authority to target and delete important system files outside its intended operational folder, effectively breaking site integrity.

Do I need to be logged in to trigger CVE-2026-16940?

No, authentication is not required to trigger this vulnerability. The flaw allows unauthenticated remote users to initiate the file deletion process. Note that this issue is strictly tied to the plugin's failure to validate paths; standard administrative actions or site visits that do not interact with the specific vulnerable file-deletion function will not trigger the bug.

Why is this a concern for my web server?

Halo Surface Signal notes that since this is a WordPress plugin, it is typically part of a public-facing web application. This means the vulnerable code is directly reachable by anyone on the internet. Because the plugin can be accessed remotely, an attacker can delete critical configuration files—such as wp-config.php—from anywhere, which is often a primary step in gaining full control over a website.

What is the first step to fix this plugin vulnerability?

Your priority is to verify if you have version 1.5.1 or newer installed across your WordPress environments. You should inventory all sites running the Custom Fields plugin to confirm presence. If you are using a version older than 1.5.1, immediately coordinate with your team to update the software or remove the plugin entirely to prevent the potential for unauthorized file deletion.

References

wpscan.com/vulnerability/a315a6ac-3ffb-4735-92ca-6e85338f8807/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.