low2.7
CVE-2026-97192
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post edito…
Impact
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
An attacker can exploit this over the network, with an administrator account, without any action by a user. If it succeeds: low risk of data or systems being changed.
Affected products · Unknown
| Product | Affected versions |
|---|---|
| Secure Custom Fields | before 6.9.8 |