CVE-2020-36742 in Custom Field Template Plugin
Summary
by MITRE • 07/01/2023
The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the edit_meta_value() function. This makes it possible for unauthenticated attackers to edit meta field values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The Custom Field Template plugin for WordPress represents a widely used tool that enables administrators to create custom meta fields for posts and pages within their WordPress installations. This plugin facilitates enhanced content management by allowing users to define additional data fields beyond the standard WordPress post attributes. However, version 2.5.1 and earlier contained a critical security flaw that significantly compromised the integrity of WordPress sites utilizing this plugin. The vulnerability stems from inadequate validation mechanisms within the plugin's core functionality, specifically affecting the edit_meta_value() function that handles meta field modifications. This weakness creates a pathway for malicious actors to manipulate content without proper authorization, undermining the fundamental security assumptions of WordPress administrative workflows.
The technical flaw manifests through the absence of proper nonce validation within the edit_meta_value() function, which serves as a cryptographic token used to verify that administrative actions originate from legitimate sources within the WordPress admin interface. Without this validation, attackers can craft malicious requests that appear to come from authenticated administrators, exploiting the trust relationship between the WordPress admin panel and its underlying plugins. The vulnerability is particularly dangerous because it does not require authentication to exploit, allowing unauthenticated attackers to manipulate meta field values through carefully crafted cross-site request forgery attacks. This occurs when administrators are tricked into clicking malicious links or visiting compromised websites that trigger the forged requests, effectively bypassing WordPress's built-in security measures.
The operational impact of this vulnerability extends beyond simple data manipulation, potentially enabling attackers to compromise entire WordPress installations through subtle but damaging modifications. Attackers could alter meta field values to inject malicious code, manipulate SEO settings, modify content presentation, or even create backdoor access points within the WordPress environment. The vulnerability's exploitation requires minimal technical skill, as it relies on social engineering techniques to trick administrators into performing actions that trigger the malicious requests. This makes the attack vector particularly dangerous in environments where administrators frequently click on links from external sources or where phishing campaigns are common. The consequences can range from content corruption and reputational damage to full system compromise, especially when combined with other vulnerabilities present in the WordPress ecosystem.
Mitigation strategies for this vulnerability require immediate attention from WordPress administrators and security teams. The primary solution involves updating to the latest version of the Custom Field Template plugin where the nonce validation has been properly implemented and verified. Organizations should also implement comprehensive monitoring of administrative actions and meta field modifications to detect potential exploitation attempts. Network-level security measures including web application firewalls and intrusion detection systems can help identify and block suspicious requests targeting the vulnerable plugin endpoints. Additionally, administrators should conduct regular security audits of their WordPress installations to identify and remediate similar vulnerabilities in other plugins or themes. The vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery issues, and falls under ATT&CK technique T1213.002 for Data from Information Repositories, emphasizing the importance of protecting administrative interfaces and maintaining proper validation controls. Security teams should also consider implementing role-based access controls and regular security training for administrators to reduce the risk of successful social engineering attacks that exploit this vulnerability.