CVE-2026-92403 — Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution

CVE-2026-92403

Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution PUBLISHED

Description (CNA)

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.

Affected (CNA)

Vendor / product	Versions
Unknown / Secure Custom Fields	affected 0 before 6.9.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/740341ca-6419-4980-8ee9-d9e5c0f8df92/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.