Unauthorized Data Access in Smart Custom Fields Plugin for WordPress

CVE-2026-4066

What is CVE-2026-4066?

The Smart Custom Fields plugin for WordPress is susceptible to unauthorized data access due to inadequate capability checks within the relational_posts_search() function. This vulnerability allows authenticated attackers, particularly those with Contributor-level access or higher, to access private and draft posts authored by others. The AJAX action, smart-cf-relational-posts-search, performs queries on posts with any status and returns complete WP_Post objects, including their content. However, it only examines the edit_posts capability, failing to validate whether the requesting user has permissions to view each specific post, thereby exposing sensitive information.

References