CVE-2016-20083 in More Fields Plugin
Summary
by MITRE • 06/15/2026
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/23/2026
The WordPress More Fields Plugin version 2.1 presents a critical cross-site request forgery vulnerability that compromises the integrity of administrative operations within the WordPress ecosystem. This weakness stems from the absence of proper CSRF token validation mechanisms within the plugin's codebase, specifically affecting the options-general.php endpoint that handles custom field management operations. The vulnerability allows malicious actors to manipulate authenticated administrator sessions through carefully crafted web pages that automatically submit requests without user consent.
The technical flaw manifests when administrators navigate to the Write/Edit page where the plugin's interface is rendered. The plugin fails to implement mandatory CSRF protection measures such as token generation, validation, and session binding that are essential for preventing unauthorized actions. Attackers can exploit this by creating malicious HTML pages containing hidden forms or javascript code that automatically submits POST and GET requests to the vulnerable endpoint. These requests bypass normal authentication checks because they appear legitimate due to the active administrator session.
The operational impact of this vulnerability extends beyond simple data manipulation as it provides attackers with persistent access to modify core content management structures. When administrators perform actions such as adding or deleting custom fields and boxes through the compromised interface, these modifications can alter the website's functionality and potentially expose sensitive data. The vulnerability is particularly dangerous because it operates silently in the background without alerting users to unauthorized activities, making detection difficult for system administrators.
Security practitioners should recognize this issue as a direct violation of established web security principles and aligns with CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities. The attack vector follows ATT&CK technique T1078.004 by leveraging valid accounts to perform unauthorized administrative functions. Organizations using WordPress More Fields Plugin version 2.1 should immediately implement mitigations including disabling the plugin until a patched version is available, implementing web application firewalls with CSRF detection capabilities, and ensuring all administrators use secure browsing practices that minimize exposure to malicious content. Additionally, regular security audits should verify that all plugins maintain proper CSRF protection mechanisms as part of comprehensive application security frameworks.