Secure Custom Fields WordPress Plugin Privilege Escalation

Executive Summary

This vulnerability affects the Secure Custom Fields WordPress plugin before version 6.9.8. When users save custom field values through the post editor, the plugin fails to re-enforce field-group location rules. This allows users with contributor-level access or higher to write custom fields normally restricted to administrators onto their own posts.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Secure Custom Fields plugin in your WordPress admin panel. If it is below 6.9.8, the vulnerability is present. Use WP-CLI with the command 'wp plugin list' to verify the version.

Useful 0 Not Useful 0

Impact Analysis

Users with contributor-level access or higher could bypass restrictions and write restricted custom fields onto their own posts. This may lead to unauthorized data exposure or manipulation of sensitive fields intended only for administrators.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Secure Custom Fields plugin to version 6.9.8 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent unauthorized custom field modifications.

Useful 0 Not Useful 0