What is the CVSS score of EUVD-2026-14618?

EUVD-2026-14618 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14618?

Organizations using all should be aware of moderate risk from CVE-2026-4066, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-14618?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress EUVD-2026-14618

| CVE-2026-4066 MEDIUM

Missing Authorization (CWE-862)

2026-03-23 Wordfence

GHSA-v295-3wx7-pwm2

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:45 euvd

EUVD-2026-14618

Analysis Generated

Mar 23, 2026 - 22:45 vuln.today

CVE Published

Mar 23, 2026 - 22:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via the smart-cf-relational-posts-search AJAX action. The function queries posts with post_status=any and returns full WP_Post objects including post_content, but only checks the generic edit_posts capability instead of verifying whether the requesting user has permission to read each individual post.

AnalysisAI

The Smart Custom Fields WordPress plugin contains an authorization bypass vulnerability in the relational_posts_search() AJAX function that allows authenticated contributors and above to access private and draft posts from other authors. Affected versions through 5.0.6 fail to perform per-post capability checks, instead relying only on a generic edit_posts check, enabling unauthorized information disclosure of sensitive post content. With a CVSS score of 4.3 and low attack complexity requiring only network access and contributor-level credentials, this vulnerability poses a moderate risk to multi-author WordPress installations.

Technical ContextAI

The Smart Custom Fields plugin (CPE: cpe:2.3:a:inc2734:smart_custom_fields:*:*:*:*:*:*:*:*) implements a relational post search feature via the smart-cf-relational-posts-search AJAX action handler in class.field-related-posts.php. The vulnerability stems from CWE-862 (Missing Authorization), where the relational_posts_search() function queries WordPress posts with post_status=any to retrieve all post objects regardless of publication state, then returns complete WP_Post objects including post_content to the requesting user. The root cause is insufficient access control: the function validates only that the user possesses the generic edit_posts capability but does not verify whether that specific user has permission to read each queried post. This design flaw allows the WordPress post access control model to be bypassed, as contributors with edit_posts capability can retrieve private and draft content authored by other users.

RemediationAI

Update the Smart Custom Fields plugin to version 5.0.7 or later immediately, as a patch has been committed to the plugin repository (see WordPress changeset 3485210). Site administrators should access the WordPress admin dashboard, navigate to Plugins, and update Smart Custom Fields to the latest available version. Until patching is completed, temporarily disable the Smart Custom Fields plugin if not actively used, or restrict user roles with edit_posts capability to trusted administrators only. Additionally, audit access logs for the smart-cf-relational-posts-search AJAX action to detect unauthorized post access attempts. Monitor WordPress user accounts for unauthorized contributor-level or higher privilege accounts that may be exploiting this vulnerability. For sites requiring continued use of the plugin before patching, implement Web Application Firewall rules to block requests to the vulnerable AJAX action endpoint.