Improper Object Access in Secure Custom Fields Plugin for WordPress
CVE-2026-97193

Currently unrated

Key Information:

Vendor

WordPress
Status
Secure Custom Fields
Vendor
CVE Published:
8 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-97193?

The Secure Custom Fields plugin for WordPress versions prior to 6.9.8 fails to properly validate user permissions for editing target objects during bidirectional relationship synchronization. This weakness allows users with contributor-level access or higher to manipulate object references on posts, users, or terms that they are not authorized to edit. The lack of appropriate checks could lead to unauthorized changes in the associated content, highlighting the importance of stringent access control measures.

Affected Version(s)

Secure Custom Fields 0 < 6.9.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-97193 - Proof of Concept

References

https://wpscan.com/vulnerability/5a5df7fe-138b-44ff-8ce4-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.