WordPress Plugin Vulnerabilities

Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution

Description

The plugin does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.

Proof of Concept

Affects Plugins

Plugin icon
secure-custom-fields
Fixed in 6.9.4

References

CVE
CVE-2026-92403

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
740341ca-6419-4980-8ee9-d9e5c0f8df92

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-17 (about 1 day ago)

Other

Published
Title
Published
2026-08-31
Title
Master Addons for Elementor < 3.2.0 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
Published
2024-04-25
Title
WP Masquerade <= 1.1.0 - Subscriber+ Account Takeover
Published
2021-09-28
Title
AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation
Published
2026-03-05
Title
Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution
Published
2022-03-21
Title
Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure