The Add Custom Fields to Media plugin for WordPress allows Cross‑Site Request Forgery (CWE‑352) due to missing nonce validation when the 'delete' parameter is processed in the admin display template. An unauthenticated attacker can issue a crafted GET request that triggers update_option() to delete an arbitrary custom media field, provided a site administrator follows a malicious link. This results in loss of media metadata and possible disruption of dependents that rely on the deleted fields, affecting data integrity and site functionality.

All installations of the Add Custom Fields to Media plugin from vendor pattihis with version 2.0.3 or earlier are vulnerable. No specific sub‑versions beyond 2.0.3 are listed; any release after 2.0.3 that includes nonce validation for the delete operation is considered safe.

The CVSS base score is 4.3, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by directing an administrator who is logged into the WordPress admin area to visit a malicious URL with the 'delete' parameter, thereby performing the deletion without requiring any additional credentials. The risk is moderate and mainly impacts the integrity of custom media field data.