PT-2026-27252 · WordPress · Smart Custom Fields

Darkestmode

·

Publicado

2026-03-23

·

Atualizado

2026-03-24

·

CVE-2026-4066

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Smart Custom Fields plugin for WordPress versions up to and including 5.0.6
Description The Smart Custom Fields plugin for WordPress has a flaw that allows unauthorized access to data. A missing capability check within the relational posts search() function permits authenticated attackers with Contributor-level access or higher to read private and draft post content from other authors. This is achieved through the smart-cf-relational-posts-search AJAX action, which queries posts with any status and returns complete post objects, including post content, but only verifies the generic edit posts capability instead of individual post access permissions.
Recommendations Update the Smart Custom Fields plugin to a version newer than 5.0.6. As a temporary workaround, consider restricting access to the smart-cf-relational-posts-search AJAX action until a patch is available.

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-4066

Produtos afetados

Smart Custom Fields