Secure Custom Fields
Monthly
Unauthenticated visitors to WordPress sites running the Secure Custom Fields plugin before 6.9.4 can submit data against a registered form other than the one that was actually rendered to them, overwriting the title and content of the post that the abused form is bound to. The vulnerability is only reachable where SCF's front-end form-submission feature is actively deployed and rendered publicly, and successful exploitation requires the attacker to enumerate a second registered form plus its bound post, which is why the assessed CVSS is a modest 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - integrity-only, low impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), but there is no KEV confirmation of active exploitation; the vendor has released a fix in Secure Custom Fields 6.9.4, so the practical priority is patching sites that use front-end forms rather than emergency response.
Unauthenticated visitors to WordPress sites running the Secure Custom Fields plugin before 6.9.4 can submit data against a registered form other than the one that was actually rendered to them, overwriting the title and content of the post that the abused form is bound to. The vulnerability is only reachable where SCF's front-end form-submission feature is actively deployed and rendered publicly, and successful exploitation requires the attacker to enumerate a second registered form plus its bound post, which is why the assessed CVSS is a modest 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - integrity-only, low impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), but there is no KEV confirmation of active exploitation; the vendor has released a fix in Secure Custom Fields 6.9.4, so the practical priority is patching sites that use front-end forms rather than emergency response.