The Custom Field Template plugin for WordPress contains a classic SQL Injection flaw (CWE‑89) that allows an attacker to inject arbitrary SQL through user‑supplied data. The vulnerability is caused by the plugin’s handling of contributed custom fields without proper sanitization of the input, enabling the execution of unintended SQL statements against the WordPress database. An attacker who succeeds could read, modify, or delete any data stored in the database, potentially exposing sensitive user information or breaking site functionality. The description explicitly identifies the flaw as a SQL Injection in versions 2.7.8 and earlier; the existence of the flaw implies that input validation or parameterized queries are missing, although the source text does not detail the exact code defect.

WordPress sites that have installed the Custom Field Template plugin developed by Hiroaki Miyashita, in any release version 2.7.8 or older, are affected. This includes any deployment where the plugin is active in the WordPress installation, regardless of theme or other plugins. Sites running newer releases (2.8 and above) are not impacted by this specific vulnerability.

The flaw is classified as high severity with a CVSS score of 8.5, indicating significant potential impact if exploited. The EPSS score of <1% shows that, as of the current data, the likelihood of an exploit occurring is low, and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is the web interface of the WordPress site, specifically through the plugin’s handling of custom field input; an attacker would need to craft malicious input data sent via HTTP requests to trigger the injection. Based on the description and common exploitation patterns for WordPress plugins, the vulnerability does not appear to directly provide remote code execution, but it enables significant data compromise and availability disruption if leveraged successfully.