This vulnerability exists because the More Fields plugin version 2.1 disables CSRF token validation on the options‑general.php endpoint. An attacker who tricks a logged‑in administrator into visiting a crafted page can send POST or GET requests that add or delete custom fields and boxes without the administrator’s consent. The consequence is that the site’s administrative configuration is altered, potentially enabling further exploitation or data loss.

WordPress sites that have the henrikmelin More Fields plugin version 2.1 installed. Any site running WordPress with this plugin, regardless of the core WordPress version, is vulnerable. No specific WordPress core version is mentioned in the advisory.

The CVSS score of 6.9 indicates moderate to high severity. Since the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, but the vulnerability can be leveraged by a web attacker who can create a malicious page that targets a logged‑in administrator. The attacker needs no special access beyond a crafted request; the vulnerability does not require network access beyond allowing standard HTTP requests to the site.