Security Alert Summary
The Secure Custom Fields WordPress plugin before 6.9.8 contains a vulnerability where the plugin fails to verify that an authenticated user is authorized to edit a target object before writing during bidirectional relationship synchronization. This can allow users with contributor-level access and above to add or remove references to their own object on posts, users, or terms they do not otherwise have permission to edit.
CVE Details
- CVE ID:
CVE-2026-97193 - Affected component: Secure Custom Fields (WordPress plugin)
- Affected versions: Versions before 6.9.8 (less than 6.9.8)
- Published: November 8, 2026 at 6:17:06 AM UTC
- Last modified: November 8, 2026 at 6:17:06 AM UTC
- CVSS v3.1 base score / severity / vector: Not provided in the CVE data
- Authentication required: Yes, authenticated user
- Privileges required: Contributor-level access or higher
- User interaction: Not specified; exploit requires actions available to the authenticated account
- Primary impact:
- Confidentiality: Possible limited exposure of relationship data or associations between objects
- Integrity: Modification of object relationships (ability to add or remove references on posts, users, or terms)
- Availability: No impact to availability indicated
- CWE / weakness ID: Not provided in the CVE data
Technical Details
The plugin does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization. In practice, when the plugin synchronizes relationships in both directions it updates a target object without confirming the requesting user has edit permission on that target.
Because the check is missing during the synchronization write, an authenticated user with contributor-level privileges or higher can add or remove a reference to their own object on arbitrary posts, users, or terms that they otherwise cannot edit. The CVE description does not name specific function names, hooks, or REST endpoints involved, so no further implementation-specific details are provided in the advisory data.
The impact is limited to modification of relationship data and related object references; the issue does not, in the provided data, indicate remote code execution, privilege escalation to administrator, or availability disruption.
How This Could Impact Your Website
Imagine a site with multiple user roles: a site owner, internal staff editors, and external contributors. A contributor account could be used to alter relationship links so the contributor’s object is referenced on posts, user profiles, or taxonomies the contributor cannot normally edit. This could change how content and user associations display on the site, and may expose or surface internal relationships you prefer to keep private.
Practical consequences may include:
- Exposure of associations between users and content that reveal internal team structures or relationships, which could indirectly disclose contact points such as email addresses.
- Increased risk of targeted phishing or social engineering if an attacker can manipulate visible relationships or user-linked content to create plausible pretexts.
- Confusion in content attribution or taxonomy organization due to unauthorized modifications of references.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts that have more permissions than required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior related to content and user relationship changes.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
