{"id":"CVE-2026-97194","kind":"vulnerability","aliases":["CVE-2026-97194"],"related":[],"title":"Secure Custom Fields WordPress plugin leaks unpublished post titles to contributors","description":"The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.","summary":"The Secure Custom Fields WordPress plugin does not check read permissions when rendering relational field values. A logged-in user with post-editing access, such as a Contributor, can see the titles and non-public statuses of other users' unpublished posts.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","secure-custom-fields","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-at-6.9.8-or-later"],"how_to_check":"- Check the installed Secure Custom Fields plugin version in the WordPress admin Plugins page or with `wp plugin get secure-custom-fields --field=version`\n- Confirm whether the site has contributor-level or higher accounts that can edit posts","fix":"- Secure Custom Fields: move to `6.9.8` or later (the sources state the plugin is fixed from 6.9.8)","status":"open","published_at":"2026-11-08T06:17:06+00:00","first_seen_at":"2026-11-08T06:46:22+00:00","triaged_at":"2026-11-08T06:47:08+00:00","updated_at":"2026-11-08T06:47:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T06:47:08Z","model":"claude-haiku-5-5","output":{"fix":"- Secure Custom Fields: move to `6.9.8` or later (the sources state the plugin is fixed from 6.9.8)","reach":"network","title":"Secure Custom Fields WordPress plugin leaks unpublished post titles to contributors","impact":"low","summary":"The Secure Custom Fields WordPress plugin does not check read permissions when rendering relational field values. A logged-in user with post-editing access, such as a Contributor, can see the titles and non-public statuses of other users' unpublished posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","secure-custom-fields","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Contributors read titles and statuses of other users' unpublished posts","analyst_note":"Ecosystem: wordpress plugin, no product data beyond the NVD description; fixed-version statement comes from the description only.","how_to_check":"- Check the installed Secure Custom Fields plugin version in the WordPress admin Plugins page or with `wp plugin get secure-custom-fields --field=version`\n- Confirm whether the site has contributor-level or higher accounts that can edit posts","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-6.9.8-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Secure Custom Fields WordPress plugin before 6.9.8 that have users with post-editing access, such as Contributors. Sites with only administrators or subscribers, or without the plugin, are not exposed by this flaw. The sources do not describe a non-default setting that is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000762,"input_tokens":4543,"output_tokens":615,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97194':14A,17A '6.9.8':78C 'access':52B,104C 'allow':98C 'check':35B,86C 'contributor':11A,56B,105C 'custom':2A,21B,29B,73C 'cve':12A,15A 'disclos':109C 'edit':51B,103C 'field':3A,22B,30B,41B,74C,97C 'format':91C 'host':25B 'leak':6A 'log':45B 'logged-in':44B 'non':63B,114C 'non-publ':62B,113C 'packag':18B 'perform':81C 'permiss':37B,85C 'plugin':5A,32B,76C 'post':8A,50B,70B,102C,121C 'post-edit':49B,101C 'public':64B,115C 'read':36B,84C 'read-permiss':83C 'relat':40B,96C 'render':39B,89C 'secur':1A,20B,28B,72C 'secure-custom-field':19B 'see':58B 'self':24B 'self-host':23B 'status':65B,116C 'titl':9A,60B,111C 'unpublish':7A,69B,120C 'user':47B,68B,99C,119C 'valu':42B,93C 'wordpress':4A,26B,31B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Secure Custom Fields WordPress plugin before 6.9.8 that have users with post-editing access, such as Contributors. Sites with only administrators or subscribers, or without the plugin, are not exposed by this flaw. The sources do not describe a non-default setting that is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","package","securecustomfields","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97194':14A,17A 'contributor':11A 'custom':2A 'cve':12A,15A 'field':3A 'leak':6A 'plugin':5A 'post':8A 'secur':1A 'titl':9A 'unpublish':7A 'wordpress':4A","search_b":"'access':52B 'check':35B 'contributor':56B 'custom':21B,29B 'edit':51B 'field':22B,30B,41B 'host':25B 'log':45B 'logged-in':44B 'non':63B 'non-publ':62B 'packag':18B 'permiss':37B 'plugin':32B 'post':50B,70B 'post-edit':49B 'public':64B 'read':36B 'relat':40B 'render':39B 'secur':20B,28B 'secure-custom-field':19B 'see':58B 'self':24B 'self-host':23B 'status':65B 'titl':60B 'unpublish':69B 'user':47B,68B 'valu':42B 'wordpress':26B,31B","search_c":"'6.9.8':78C 'access':104C 'allow':98C 'check':86C 'contributor':105C 'custom':73C 'disclos':109C 'edit':103C 'field':74C,97C 'format':91C 'non':114C 'non-publ':113C 'perform':81C 'permiss':85C 'plugin':76C 'post':102C,121C 'post-edit':101C 'public':115C 'read':84C 'read-permiss':83C 'relat':96C 'render':89C 'secur':72C 'status':116C 'titl':111C 'unpublish':120C 'user':99C,119C 'valu':93C 'wordpress':75C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97194","severity":null,"published_at":"2026-11-08T06:17:06+00:00","modified_at":"2026-11-08T06:17:06+00:00","first_seen_at":"2026-11-08T06:46:22+00:00","fetched_at":"2026-11-08T06:46:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}