CVE-2026-97193
Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
What each source reports
CVE List No score
Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
- Record
CVE-2026-97193- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-2j9h-chv5-8537 No score
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to...
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
- Record
GHSA-2j9h-chv5-8537- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97193 is a vulnerability with no CVSS score yet in Unknown Secure Custom Fields, published November 8, 2026. No source lists public exploit code. No source names a fixed version.