Unrated severityNVD Advisory· Published Nov 8, 2026
CVE-2026-97193
CVE-2026-97193
Description
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <6.9.8
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.