The vulnerability is an insecure direct object reference that allows a user with contributor-level access or higher to delete any media attachment on the site by providing a numeric attachment ID in the file‑field parameter when editing a post. This results in content loss and broken page functionality and is rooted in the missing validation of the key used to identify the attachment, a classic example of CWE‑639. The attack only succeeds if the contributing post uses a Custom Field Template that includes a file‑type field and does not have its mediaRemove option enabled, which is the default configuration.

The issue affects installations of the WordPress plugin Custom Field Template, version 2.7.8 and all earlier releases. The plugin is developed by hiroaki‑miyashita and is commonly used in many WordPress sites to add dynamic fields to posts and pages.

The CVSS score of this flaw is 4.3, indicating a moderate effect level, and there is no EPSS data or KEV listing available at this time. Because the exploitation requires only contributor‑level rights and a standard post structure, the vulnerability is potentially exploitable in any site that has not disabled or updated the plugin. Attackers would need to determine an attachment ID, which can be discovered through the media library or by inspecting existing URLs, and then submit a specially crafted request to trigger deletion. The vulnerability does not provide direct code execution or privilege escalation beyond the contributor role.