Improper Form Verification in Secure Custom Fields Plugin for WordPress
CVE-2026-92403

Currently unrated

Key Information:

Vendor

WordPress
Status
Secure Custom Fields
Vendor
CVE Published:
19 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-92403?

The Secure Custom Fields WordPress plugin prior to version 6.9.4 suffers from a vulnerability where it fails to validate that a front-end form submission corresponds to the correct form instance displayed to a visitor. This flaw allows unauthenticated users to target different registered forms and potentially modify the title and content of posts associated with those forms. As a result, this can lead to unauthorized modifications and impact the integrity of the site's content.

Affected Version(s)

Secure Custom Fields 0 < 6.9.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-92403 - Proof of Concept

References

https://wpscan.com/vulnerability/740341ca-6419-4980-8ee9-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Charles Vosburgh
WPScan
.