CVE-2026-4068 is a CSRF vulnerability in the Add Custom Fields to Media WordPress plugin (versions up to 2.0.3). The issue arises because the plugin fails to validate a nonce token on the 'delete field' operation, which processes the $_GET['delete'] parameter and calls update_option() without verifying the request's authenticity. This allows unauthenticated attackers to perform unauthorized deletions of custom media fields if they can trick an administrator into clicking a malicious link. The 'add field' operation is properly protected by nonce validation, isolating the vulnerability to the deletion functionality.

Exploitation of this vulnerability allows an attacker to delete arbitrary custom media fields without authentication by leveraging a CSRF attack against an administrator. This results in integrity loss of the affected WordPress site's custom media field data. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links and consider disabling or replacing the plugin if possible. Implementing manual nonce validation for the delete operation or applying custom CSRF protections can mitigate the risk. Monitor official vendor channels for updates or patches addressing this vulnerability.