{"id":"CVE-2026-97193","kind":"vulnerability","aliases":["CVE-2026-97193"],"related":[],"title":"Secure Custom Fields WordPress plugin: contributors can alter other users' content","description":"The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.","summary":"The Secure Custom Fields WordPress plugin before 6.9.8 skips an authorization check when syncing bidirectional relationships. A logged-in contributor can add or remove references to their own objects on posts, users, or terms they cannot otherwise edit.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","secure-custom-fields","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","version-6.9.8-or-later"],"how_to_check":"- Check the installed version of Secure Custom Fields in the WordPress admin plugins list or with `wp plugin get secure-custom-fields --field=version`\n- Confirm whether the site allows contributor-level accounts or higher","fix":"- Secure Custom Fields: move to version `6.9.8` or later","status":"open","published_at":"2026-11-08T06:17:06+00:00","first_seen_at":"2026-11-08T06:46:22+00:00","triaged_at":"2026-11-08T06:47:07+00:00","updated_at":"2026-11-08T06:47:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:07Z","model":"claude-haiku-5-5","output":{"fix":"- Secure Custom Fields: move to version `6.9.8` or later","reach":"network","title":"Secure Custom Fields WordPress plugin: contributors can alter other users' content","impact":"medium","summary":"The Secure Custom Fields WordPress plugin before 6.9.8 skips an authorization check when syncing bidirectional relationships. A logged-in contributor can add or remove references to their own objects on posts, users, or terms they cannot otherwise edit.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","secure-custom-fields","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"contributor alters relationships on content they cannot edit","analyst_note":"","how_to_check":"- Check the installed version of Secure Custom Fields in the WordPress admin plugins list or with `wp plugin get secure-custom-fields --field=version`\n- Confirm whether the site allows contributor-level accounts or higher","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.9.8-or-later","no-contributor-accounts"],"who_is_affected":"Sites running Secure Custom Fields before 6.9.8 that use bidirectional relationship fields and have users with contributor access or above. Sites without multiple logged-in contributors or without relationship fields are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4561,"output_tokens":519,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97193':14A,17A '6.9.8':34B,73C 'access':101C 'add':49B,105C 'allow':81C,95C 'alter':8A 'arbitrari':115C 'author':37B 'bidirect':41B,92C 'cannot':63B,121C 'check':38B 'content':11A 'contributor':6A,47B,99C 'contributor-level':98C 'custom':2A,21B,29B,68C 'cve':12A,15A 'edit':65B,83C,123C 'field':3A,22B,30B,69C 'host':25B 'level':100C 'log':45B 'logged-in':44B 'object':56B,86C,113C 'otherwis':64B,122C 'packag':18B 'plugin':5A,32B,71C 'post':58B,116C 'refer':52B,109C 'relationship':42B,93C 'remov':51B,107C 'secur':1A,20B,28B,67C 'secure-custom-field':19B 'self':24B 'self-host':23B 'skip':35B 'sync':40B 'synchron':94C 'target':85C 'term':61B,119C 'user':10A,59B,79C,96C,117C 'verifi':76C 'wordpress':4A,26B,31B,70C 'write':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running Secure Custom Fields before 6.9.8 that use bidirectional relationship fields and have users with contributor access or above. Sites without multiple logged-in contributors or without relationship fields are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","securecustomfields","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97193':14A,17A 'alter':8A 'content':11A 'contributor':6A 'custom':2A 'cve':12A,15A 'field':3A 'plugin':5A 'secur':1A 'user':10A 'wordpress':4A","search_b":"'6.9.8':34B 'add':49B 'author':37B 'bidirect':41B 'cannot':63B 'check':38B 'contributor':47B 'custom':21B,29B 'edit':65B 'field':22B,30B 'host':25B 'log':45B 'logged-in':44B 'object':56B 'otherwis':64B 'packag':18B 'plugin':32B 'post':58B 'refer':52B 'relationship':42B 'remov':51B 'secur':20B,28B 'secure-custom-field':19B 'self':24B 'self-host':23B 'skip':35B 'sync':40B 'term':61B 'user':59B 'wordpress':26B,31B","search_c":"'6.9.8':73C 'access':101C 'add':105C 'allow':81C,95C 'arbitrari':115C 'bidirect':92C 'cannot':121C 'contributor':99C 'contributor-level':98C 'custom':68C 'edit':83C,123C 'field':69C 'level':100C 'object':86C,113C 'otherwis':122C 'plugin':71C 'post':116C 'refer':109C 'relationship':93C 'remov':107C 'secur':67C 'synchron':94C 'target':85C 'term':119C 'user':79C,96C,117C 'verifi':76C 'wordpress':70C 'write':88C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97193","severity":null,"published_at":"2026-11-08T06:17:06+00:00","modified_at":"2026-11-08T06:17:06+00:00","first_seen_at":"2026-11-08T06:46:22+00:00","fetched_at":"2026-11-08T06:46:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}