EUVD-2026-14618
GHSA-v295-3wx7-pwm2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via the smart-cf-relational-posts-search AJAX action. The function queries posts with post_status=any and returns full WP_Post objects including post_content, but only checks the generic edit_posts capability instead of verifying whether the requesting user has permission to read each individual post.
AnalysisAI
The Smart Custom Fields WordPress plugin contains an authorization bypass vulnerability in the relational_posts_search() AJAX function that allows authenticated contributors and above to access private and draft posts from other authors. Affected versions through 5.0.6 fail to perform per-post capability checks, instead relying only on a generic edit_posts check, enabling unauthorized information disclosure of sensitive post content. With a CVSS score of 4.3 and low attack complexity requiring only network access and contributor-level credentials, this vulnerability poses a moderate risk to multi-author WordPress installations.
Technical ContextAI
The Smart Custom Fields plugin (CPE: cpe:2.3:a:inc2734:smart_custom_fields:*:*:*:*:*:*:*:*) implements a relational post search feature via the smart-cf-relational-posts-search AJAX action handler in class.field-related-posts.php. The vulnerability stems from CWE-862 (Missing Authorization), where the relational_posts_search() function queries WordPress posts with post_status=any to retrieve all post objects regardless of publication state, then returns complete WP_Post objects including post_content to the requesting user. The root cause is insufficient access control: the function validates only that the user possesses the generic edit_posts capability but does not verify whether that specific user has permission to read each queried post. This design flaw allows the WordPress post access control model to be bypassed, as contributors with edit_posts capability can retrieve private and draft content authored by other users.
RemediationAI
Update the Smart Custom Fields plugin to version 5.0.7 or later immediately, as a patch has been committed to the plugin repository (see WordPress changeset 3485210). Site administrators should access the WordPress admin dashboard, navigate to Plugins, and update Smart Custom Fields to the latest available version. Until patching is completed, temporarily disable the Smart Custom Fields plugin if not actively used, or restrict user roles with edit_posts capability to trusted administrators only. Additionally, audit access logs for the smart-cf-relational-posts-search AJAX action to detect unauthorized post access attempts. Monitor WordPress user accounts for unauthorized contributor-level or higher privilege accounts that may be exploiting this vulnerability. For sites requiring continued use of the plugin before patching, implement Web Application Firewall rules to block requests to the vulnerable AJAX action endpoint.
More in Smart Custom Fields
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today