Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (line 24-36), but the 'delete field' operation (lines 38-49) processes the $_GET['delete'] parameter and calls update_option() without any nonce verification. This makes it possible for unauthenticated attackers to delete arbitrary custom media fields via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-4068 The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonc… https://www.cve.org/CVERecord?id=CVE-2026-4068
Post summary
The entry reports a CSRF vulnerability in the WordPress Add Custom Fields to Media plugin (v ≤ 2.0.3), offering technical details but no exploit, PoC, or patch information.
CVE-2026-4068 Cross-Site Request Forgery in WordPress Add Custom Fields to Media Plugin... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4068 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet merely announces the existence of CVE-2026-4068 and provides links to detailed vulnerability information, without any PoC, exploit, patch, or technical specifics.