Custom Fields vulnerabilities
We track 1 vulnerability in Custom Fields products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
1vulnerabilities
1critical
0high
0exploited
10.0average CVSS score
Latest Custom Fields vulnerabilities
- 10.0 Critical severity
Custom Fields: Improper Limitation of a Pathname to a Restricted Directory
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.