CVE-2026-97194 · Package
NO FIX YET · SEE WHAT TO DO
The Secure Custom Fields WordPress plugin does not check read permissions when rendering relational field values. A logged-in user with post-editing access, such as a Contributor, can see the titles and non-public statuses of other users' unpublished posts.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Secure Custom Fields WordPress plugin before 6.9.8 that have users with post-editing access, such as Contributors. Sites with only administrators or subscribers, or without the plugin, are not exposed by this flaw. The sources do not describe a non-default setting that is required.
Not affected if no-contributor-accounts, plugin-at-6.9.8-or-later
Who cares secure-custom-fields, self-hosted, wordpress
wp plugin get secure-custom-fields --field=version6.9.8 or later (the sources state the plugin is fixed from 6.9.8)The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.