CVE-2026-97194 in Secure Custom Fields Plugin
Summary
by MITRE • 11/08/2026
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in Secure Custom Fields versions prior to 6.9.8 represents a critical failure in server-side authorization logic within a widely used WordPress plugin designed for creating custom post meta fields. The core technical flaw lies in the rendering and formatting process of relational fields, which are intended to link posts together based on specific criteria such as author or category. When these fields are rendered on the frontend or backend interface, the application retrieves data from related posts but fails to verify whether the currently authenticated user possesses read permissions for those specific target resources. This oversight means that the system treats all relational data as publicly accessible regardless of the privacy settings associated with the linked content. Consequently, any user account possessing at least Contributor-level privileges can exploit this logic error by constructing requests or interacting with forms that trigger the display of these relational fields, thereby bypassing standard WordPress capability checks that would normally restrict access to private or draft posts belonging to other users.
The operational impact of this vulnerability is significant for organizations relying on granular content management workflows where unpublished drafts contain sensitive information before publication. Attackers can leverage their existing low-privilege accounts to enumerate and disclose the titles, metadata, and non-public statuses of other users' unpublished posts. This constitutes a clear violation of confidentiality principles, as it exposes internal operational details that should remain hidden from lower-level contributors. For instance, if an editor has drafted a confidential article or a competitor analysis while in draft status, a contributor could potentially view this information through the misconfigured relational fields. This disclosure not only compromises data privacy but also aids attackers in reconnaissance efforts by revealing content strategies and internal structures without requiring elevated privileges such as Administrator access.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures to enforce proper authorization checks before granting access to sensitive resources. It is further categorized under CWE-601, URL Redirection to Untrusted Site (Open Redirect) in some contexts if the relational links are clickable and lead directly to unverified content, but primarily it fits CWE-862, Missing Authorization, as the system fails to verify user permissions against the requested resource. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials with limited privileges to access unauthorized information, and potentially T1005, Data from Local System, by extracting sensitive data stored within the application's database through improper interface usage.
Mitigation strategies must prioritize immediate version updates as the primary defense vector. Administrators should upgrade Secure Custom Fields to version 6.9.8 or later where this authorization check has been implemented and validated. In scenarios where updating is not immediately feasible, temporary workarounds include restricting user roles that have access to edit posts containing custom fields with relational configurations. Additionally, implementing a Web Application Firewall rule set can help detect anomalous patterns of data retrieval associated with these specific field types, although this is less effective than patching the underlying code logic. Long-term remediation involves adopting secure coding practices that enforce explicit authorization checks at every point where sensitive data is rendered or transmitted to the client side, ensuring that access control decisions are made based on both user roles and resource-specific permissions rather than relying solely on general post-editing capabilities.