CVE-2026-16940 is a path traversal vulnerability (CWE-22) in the Custom Fields WordPress plugin prior to version 1.5.1. The flaw arises because the plugin does not properly validate file paths supplied by users before performing file deletion operations. This allows unauthenticated users to delete arbitrary files on the server, potentially including critical configuration files such as wp-config.php. The vulnerability has a CVSS 3.1 base score of 10.0, indicating it is critical with network attack vector, no privileges required, no user interaction, and impacts integrity and availability with scope change. No patch or official remediation information is currently available.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server. This can include critical WordPress configuration files, leading to a complete site compromise or denial of service. The vulnerability impacts the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and consider disabling it if possible to prevent exploitation.