# CVE-2026-97192: Secure Custom Fields authorization bypass in post editor

Source: https://junglewise.ai/threats/cve-2026-97192-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-97192 · Severity: info · Published 2026-11-08

Secure Custom Fields is a WordPress plugin that manages custom metadata fields on posts. The plugin fails to enforce access restrictions when saving posts through the editor, allowing contributors and other low-privilege users to modify custom fields that should only be editable by administrators, potentially exposing or altering sensitive site data.

Technologies: [Secure Custom Fields](https://junglewise.ai/threats/technologies/secure-custom-fields). Vendors: [Secure Custom Fields](https://junglewise.ai/threats/vendors/secure-custom-fields).

## Quick answers

**Is CVE-2026-97192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97192 being exploited in the wild.

**How severe is CVE-2026-97192?** Informational severity, published 8 November 2026.

**Which products and versions are affected?** Secure Custom Fields before 6.9.8.

**Is there a fix for CVE-2026-97192?** Yes: fixed in 6.9.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97192 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97192?** Check whether you run Secure Custom Fields at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.9.8

## Technical details

The vulnerability is a broken access control issue (CWE-284) in the post save path where the plugin does not re-apply field-group location rules, allowing users with contributor-level access to bypass restrictions. An attacker with contributor or higher privileges can inject custom field values into posts via the post editor save endpoint without triggering the normal authorization checks. The vulnerability affects versions before 6.9.8.

## Affected products

- Secure Custom Fields Secure Custom Fields before 6.9.8

## Timeline

- 2026-11-05: disclosed
- 2026-11-08: patched

## References

- [https://wpscan.com/vulnerability/e0ac5bc9-2450-4ff0-93d7-9111cf3efa36/](https://wpscan.com/vulnerability/e0ac5bc9-2450-4ff0-93d7-9111cf3efa36/)

## Related threats

- [Secure Custom Fields WordPress plugin stored XSS in field definitions](https://junglewise.ai/threats/cve-2026-97195-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not)
- [Secure Custom Fields WordPress plugin permission check bypass in relational fields](https://junglewise.ai/threats/cve-2026-97194-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not)