PT-2026-27252 · WordPress · Smart Custom Fields

Darkestmode

·

Published

2026-03-23

·

Updated

2026-03-24

·

CVE-2026-4066

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Smart Custom Fields plugin for WordPress versions up to and including 5.0.6
Description The Smart Custom Fields plugin for WordPress has a flaw that allows unauthorized access to data. A missing capability check within the relational posts search() function permits authenticated attackers with Contributor-level access or higher to read private and draft post content from other authors. This is achieved through the smart-cf-relational-posts-search AJAX action, which queries posts with any status and returns complete post objects, including post content, but only verifies the generic edit posts capability instead of individual post access permissions.
Recommendations Update the Smart Custom Fields plugin to a version newer than 5.0.6. As a temporary workaround, consider restricting access to the smart-cf-relational-posts-search AJAX action until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4066

Affected Products

Smart Custom Fields