CVE-2026-97192
Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
What each source reports
CVE List No score
Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
- Record
CVE-2026-97192- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-488p-3q24-423r No score
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location...
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
- Record
GHSA-488p-3q24-423r- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97192 is a vulnerability with no CVSS score yet in Unknown Secure Custom Fields, published November 8, 2026. No source lists public exploit code. No source names a fixed version.