The Custom Field Template plugin for WordPress has a security issue that affects versions up to 2.5.1. Attackers can make a specially crafted request, or link, that a site administrator can click on which would let them edit certain meta field values without authentication. This happens because the edit_meta_value() function is not correctly validating the nonce, which is a security measure.