{"affected":[{"defaultStatus":"unaffected","product":"Secure Custom Fields","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.9.8","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-97194","cwes":["CWE-200"],"description":"The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a3987e3b-fa56-4eb0-995d-e53536a336a8/"}],"kev":null,"metrics":[],"modifiedAt":1794117628369,"publishedAt":1794117628369,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a3987e3b-fa56-4eb0-995d-e53536a336a8/"}],"remediation":[],"revision":"019badb52805371c26758778a9746f09e1f6f5e3367aad9b3b8ef2885e0dcc38","sources":[{"modifiedAt":1794117628369,"name":"CNA: WPScan","retrievedAt":1794118124660,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97194"}],"ssvc":null,"status":"published","title":"Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields","updatedAt":1794118124660}