CVE-2026-9855 describes an SQL Injection vulnerability in the Custom Field Template plugin for WordPress, affecting all versions up to and including 2.7.8. The flaw exists because the 'post_ID' parameter is not properly escaped before being used in SQL queries, allowing authenticated users with contributor-level permissions or higher to inject additional SQL commands. The permission check using current_user_can('edit_post', $id) is bypassed because WordPress casts the $id parameter to an integer for permission checks but passes the unsanitized string to the SQL query. A valid nonce is also required but can be obtained legitimately by contributor-level users from the post edit screen.

An attacker with contributor-level access or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure as per the CVSS vector (Confidentiality: High, Integrity: None, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access where possible and monitor for suspicious activity related to the Custom Field Template plugin. Applying principle of least privilege and disabling or removing the plugin if not needed may reduce risk.