CVE-2026-97192: Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

Q: Who can exploit this issue?

A user with contributor-level access or higher can exploit it against their own posts. The affected custom fields are those configured to be restricted to administrators.

Q: What access or interaction does exploitation require?

The attacker must be able to submit values through the WordPress post editor save path. No separate administrator action is described.

Q: Are administrator-restricted fields protected by their configured location rules?

Not in affected versions when values are persisted through the post editor save path. The plugin does not re-apply the field-group location rules during that save operation.

Q: How can I tell whether content may have been affected?

Review posts created or edited by contributor-level and other non-administrator users for values in custom fields that were intended to be administrator-restricted. The provided information does not identify a specific audit log entry or indicator of exploitation.

Published Nov 8, 2026

Updated

The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Secure Custom Fields to a version that resolves this vulnerability.
Fixed in 6.9.8

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access or higher can exploit it against their own posts. The affected custom fields are those configured to be restricted to administrators.

What access or interaction does exploitation require?

The attacker must be able to submit values through the WordPress post editor save path. No separate administrator action is described.

Are administrator-restricted fields protected by their configured location rules?

Not in affected versions when values are persisted through the post editor save path. The plugin does not re-apply the field-group location rules during that save operation.

How can I tell whether content may have been affected?

Review posts created or edited by contributor-level and other non-administrator users for values in custom fields that were intended to be administrator-restricted. The provided information does not identify a specific audit log entry or indicator of exploitation.

CVE-2026-97192: Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or interaction does exploitation require?

Are administrator-restricted fields protected by their configured location rules?

How can I tell whether content may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or interaction does exploitation require?

Are administrator-restricted fields protected by their configured location rules?

How can I tell whether content may have been affected?