CVE-2026-97193: Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Q: Which sites are exposed?

Sites using Secure Custom Fields versions before 6.9.8 are affected if users have contributor-level access or higher and can interact with bidirectional relationship synchronization.

Q: What access does an attacker need?

An attacker needs an authenticated WordPress account with contributor-level privileges or above. They can add or remove a reference to an object they control on arbitrary posts, users, or terms that they are not otherwise permitted to edit.

Q: What should be prioritized for remediation?

Update Secure Custom Fields to version 6.9.8 or later. Until updating, restrict contributor-level and higher accounts to trusted users, because those accounts can trigger the unauthorized relationship updates.

Q: How can administrators assess potential impact?

Review relationship-field changes involving posts, users, and terms for references added to or removed from objects owned by lower-privileged users. Pay particular attention to changes initiated by contributor-level or other non-administrative accounts.

Published Nov 8, 2026

Updated

The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Secure Custom Fields WordPress plugin to a version that resolves this vulnerability.
Fixed in 6.9.8

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed?

Sites using Secure Custom Fields versions before 6.9.8 are affected if users have contributor-level access or higher and can interact with bidirectional relationship synchronization.

What access does an attacker need?

An attacker needs an authenticated WordPress account with contributor-level privileges or above. They can add or remove a reference to an object they control on arbitrary posts, users, or terms that they are not otherwise permitted to edit.

What should be prioritized for remediation?

Update Secure Custom Fields to version 6.9.8 or later. Until updating, restrict contributor-level and higher accounts to trusted users, because those accounts can trigger the unauthorized relationship updates.

How can administrators assess potential impact?

Review relationship-field changes involving posts, users, and terms for references added to or removed from objects owned by lower-privileged users. Pay particular attention to changes initiated by contributor-level or other non-administrative accounts.

CVE-2026-97193: Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Remediation

Event History

Frequently Asked Questions

Which sites are exposed?

What access does an attacker need?

What should be prioritized for remediation?

How can administrators assess potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed?

What access does an attacker need?

What should be prioritized for remediation?

How can administrators assess potential impact?