CVE-2026-97192 · Package
NO FIX YET · SEE WHAT TO DO
The Secure Custom Fields plugin for WordPress skips its field-group location rules when saving values from the post editor. A contributor-level user can therefore write custom fields that the site limited to administrators onto their own posts.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Secure Custom Fields plugin before 6.9.8 that let contributor-level users edit posts are exposed. Sites where only administrators or editors write posts, or that do not use the plugin, can skip it.
Not affected if no-contributor-users, plugin-not-installed, version-6.9.8-or-later
Who cares secure-custom-fields, self-hosted, wordpress
wp plugin get secure-custom-fields --field=version6.9.8 or later, as the description states the flaw exists before 6.9.8The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.