CVE-2026-16940 — Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the serv…
Published: 2026-08-05 · CVSS: 10.0 · CVSS 3.1
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7