CVE-2016-20083: WordPress More Fields Plugin CSRF Vulnerability – Exploitation, Remediation & Detection

Technical summary

CVE-2016-20083 is a CSRF vulnerability (CWE-352) in More Fields Plugin 2.1 arising from disabled or improperly implemented CSRF token validation. The flaw permits unauthenticated attackers to forge requests targeting the options-general.php endpoint, enabling unauthorized POST and GET operations that add or delete custom field definitions and metaboxes within the WordPress admin Write/Edit interface. The attack requires social engineering—tricking an authenticated admin into visiting a malicious page—but no special privileges or complex exploitation steps.

Business impact

A successful CSRF attack could allow threat actors to alter a site's custom field structure without administrator awareness, potentially disrupting content workflows, hiding fields from editors, or modifying metadata in ways that affect site functionality. While data confidentiality is not directly compromised, integrity is at risk. If custom fields drive business logic, commerce workflows, or content governance, unauthorized modifications could cascade into operational disruption or compliance violations.

Affected systems

WordPress sites running the More Fields plugin version 2.1 are affected. Any installation with this specific plugin version and an authenticated administrator session is at risk if the administrator is socially engineered into visiting an attacker-controlled webpage. The vulnerability does not require the site to be publicly exposed; it targets the authentication relationship between admin and browser.

Exploitability

The CVSS 3.1 score of 5.3 (MEDIUM) reflects moderate exploitability: network-based attack, low complexity, no special privileges needed by the attacker, but user interaction (admin click/visit) is required. An attacker would host a malicious page containing hidden CSRF payloads and use phishing, email, or social engineering to redirect an admin to that page. The attack is not zero-click, but once an admin visits, the damage happens silently in the background.

Remediation

Immediate action: disable or uninstall the More Fields plugin version 2.1 from all WordPress installations until a patched version is released. Verify against the plugin vendor's security advisory for any available updates. If the plugin is critical to operations, contact the vendor for a timeline or workaround. As an interim measure, restrict admin access to trusted networks via firewall rules or IP whitelisting to reduce the likelihood of successful social engineering. Review WordPress admin logs for any suspicious options-general.php modifications.

Patch guidance

Check the More Fields plugin vendor's official advisory and repository for a patched version address. Apply any available updates as soon as testing confirms compatibility with your WordPress version and other active plugins. Until a patch is available, the safest approach is to uninstall the plugin. If the plugin is no longer maintained, consider migrating to an alternative custom fields solution (such as Advanced Custom Fields or native WordPress block editor features) and deactivate More Fields entirely.

Detection guidance

Monitor WordPress admin logs and web server access logs for POST/GET requests to options-general.php originating from unexpected referrers or user-agents. Implement a Web Application Firewall (WAF) rule to flag or block requests to options-general.php that lack proper referer headers or originate from external sites. Review audit logs for additions or deletions of custom field definitions, especially those timestamped during or shortly after known phishing campaigns or unusual admin browsing activity. Enable WordPress security logging plugins to capture admin action history.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability warrants timely remediation because it directly targets administrator accounts and can modify site structure without leaving obvious user-facing traces. The plugin's role in content management means unauthorized changes could affect editorial workflows or content integrity. The attack is straightforward to execute via phishing, and the barrier to exploitation is low. Organizations should prioritize patching or removal within 1–2 weeks, especially if the plugin is actively used.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields 5.3 MEDIUM severity. The 'N' for user interaction (UI:N) in the vector refers to the attacker's perspective; however, practical exploitation still requires social engineering to trick an admin into visiting a malicious page. The low CVSS reflects absence of confidentiality impact and contained integrity risk, but the realistic attack surface is broader than the vector alone suggests, justifying prompt action.

Frequently asked questions