CVE-2026-16940 — Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

CVE-2026-16940

Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal PUBLISHED

Description (CNA)

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.

Affected (CNA)

Vendor / product	Versions
Unknown / Custom Fields	affected 0 before 1.5.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a315a6ac-3ffb-4735-92ca-6e85338f8807/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.