Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Secure Custom Fields by Unknown
CVE-2026-92403 (GCVE-0-2026-92403)
Vulnerability from nvd – Published: 2026-09-19 06:00 – Updated: 2026-09-19 13:17
VLAI
EPSS
VEX
Title
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution
Summary
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:11 UTC
CWE
- CWE-863 Incorrect Authorization
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/740341ca-6419-49… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Secure Custom Fields |
Affected:
0 , < 6.9.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-92403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:11:21.180656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:17:56.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Custom Fields",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Charles Vosburgh"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T06:00:17.680Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/740341ca-6419-4980-8ee9-d9e5c0f8df92/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Secure Custom Fields \u003c 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-92403",
"datePublished": "2026-09-19T06:00:17.680Z",
"dateReserved": "2026-09-16T08:52:01.638Z",
"dateUpdated": "2026-09-19T13:17:56.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9529 (GCVE-0-2024-9529)
Vulnerability from nvd – Published: 2024-11-15 06:00 – Updated: 2024-11-15 18:38
VLAI
EPSS
VEX
Title
Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
Summary
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-15 18:32 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/dd3cc8d8-4dff-47… | exploitvdb-entrytechnical-description |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Secure Custom Fields |
Affected:
6.3.7 , < 6.3.9
(semver)
|
|
| Unknown | Secure Custom Fields |
Affected:
0 , < 6.3.6.3
(semver)
|
|
| Unknown | Advanced Custom Fields Pro |
Affected:
0 , < 6.3.9
(semver)
|
|
| wpengine | advanced_custom_field_pro |
Affected:
0 , < 6.3.9
(semver)
cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:* |
|
| wpengine | advanced_custom_fields |
Affected:
0 , < 6.3.6.3
(semver)
Affected: 6.3.7 , < 6.3.9 (semver) cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "advanced_custom_field_pro",
"vendor": "wpengine",
"versions": [
{
"lessThan": "6.3.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "advanced_custom_fields",
"vendor": "wpengine",
"versions": [
{
"lessThan": "6.3.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.3.9",
"status": "affected",
"version": "6.3.7",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-9529",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-15T18:32:21.308252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T18:38:37.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Custom Fields",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.9",
"status": "affected",
"version": "6.3.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Secure Custom Fields",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Advanced Custom Fields Pro",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Automattic Security Team"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T06:00:08.369Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Secure Custom Fields \u003c 6.3.6.3 - Admin+ Remote Code Execution",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2024-9529",
"datePublished": "2024-11-15T06:00:08.369Z",
"dateReserved": "2024-10-04T15:01:44.589Z",
"dateUpdated": "2024-11-15T18:38:37.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-92403 (GCVE-0-2026-92403)
Vulnerability from cvelistv5 – Published: 2026-09-19 06:00 – Updated: 2026-09-19 13:17
VLAI
EPSS
VEX
Title
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution
Summary
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:11 UTC
CWE
- CWE-863 Incorrect Authorization
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/740341ca-6419-49… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Secure Custom Fields |
Affected:
0 , < 6.9.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-92403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:11:21.180656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:17:56.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Custom Fields",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Charles Vosburgh"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T06:00:17.680Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/740341ca-6419-4980-8ee9-d9e5c0f8df92/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Secure Custom Fields \u003c 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-92403",
"datePublished": "2026-09-19T06:00:17.680Z",
"dateReserved": "2026-09-16T08:52:01.638Z",
"dateUpdated": "2026-09-19T13:17:56.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9529 (GCVE-0-2024-9529)
Vulnerability from cvelistv5 – Published: 2024-11-15 06:00 – Updated: 2024-11-15 18:38
VLAI
EPSS
VEX
Title
Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
Summary
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-15 18:32 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/dd3cc8d8-4dff-47… | exploitvdb-entrytechnical-description |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Secure Custom Fields |
Affected:
6.3.7 , < 6.3.9
(semver)
|
|
| Unknown | Secure Custom Fields |
Affected:
0 , < 6.3.6.3
(semver)
|
|
| Unknown | Advanced Custom Fields Pro |
Affected:
0 , < 6.3.9
(semver)
|
|
| wpengine | advanced_custom_field_pro |
Affected:
0 , < 6.3.9
(semver)
cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:* |
|
| wpengine | advanced_custom_fields |
Affected:
0 , < 6.3.6.3
(semver)
Affected: 6.3.7 , < 6.3.9 (semver) cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "advanced_custom_field_pro",
"vendor": "wpengine",
"versions": [
{
"lessThan": "6.3.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "advanced_custom_fields",
"vendor": "wpengine",
"versions": [
{
"lessThan": "6.3.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.3.9",
"status": "affected",
"version": "6.3.7",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-9529",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-15T18:32:21.308252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T18:38:37.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Custom Fields",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.9",
"status": "affected",
"version": "6.3.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Secure Custom Fields",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Advanced Custom Fields Pro",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Automattic Security Team"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T06:00:08.369Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Secure Custom Fields \u003c 6.3.6.3 - Admin+ Remote Code Execution",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2024-9529",
"datePublished": "2024-11-15T06:00:08.369Z",
"dateReserved": "2024-10-04T15:01:44.589Z",
"dateUpdated": "2024-11-15T18:38:37.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}