CVE-2026-9855 hiroaki-miyashita CVE debrief

Who should care

WordPress site administrators, security teams, and developers using the Custom Field Template plugin should assess exposure and apply patches or updates to prevent SQL injection attacks.

Why it matters

CVE-2026-9855 is a SQL injection vulnerability in the Custom Field Template plugin for WordPress. Authenticated attackers with contributor-level access can inject SQL queries to extract sensitive database information. WordPress site administrators and security teams should assess exposure and apply patches or updates to prevent SQL injection attacks.

• SQL query injection and potential data extraction
• Bypassing capability checks for contributor-level access
• Potential for sensitive information disclosure
• Verification of patch application and vulnerability remediation

Technical summary

The Custom Field Template plugin for WordPress is vulnerable to SQL injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The capability check via current_user_can('edit_post', $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink. A valid nonce, which is also required, can be legitimately obtained by any Contributor-level user from the post edit screen.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Custom Field Template plugin version is 2.7.8 or earlier.
• Verify contributor-level access controls and SQL query sanitization in place.
• Apply patches or updates to the Custom Field Template plugin.
• Monitor for suspicious SQL queries and database access attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows authenticated attackers with contributor-level access to inject SQL queries. The capability check is bypassable due to internal casting of $id to an integer for permission evaluation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.