CVE-2026-16940

CVE-2026-16940 concerns the Custom Fields WordPress plugin prior to 1.5.1. The issue is a path traversal vulnerability that does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (e.g., wp-config.php). This can lead to a...