The Smart Custom Fields plugin for WordPress contains a missing capability check in the relational_posts_search() function. As a result, authenticated users with Contributor-level access or higher can trigger the smart-cf-relational-posts-search AJAX action and retrieve full WP_Post objects, including post_content, for posts with post_status=any. This allows such users to read private and draft content belonging to other authors, thereby exposing sensitive information that should be restricted.

The vulnerability affects the inc2734 Smart Custom Fields plugin, versions up to and including 5.0.6, which is distributed as a WordPress plugin. Any WordPress installation that has this plugin activated at these or earlier versions is susceptible until the functionality is updated or removed.

With a CVSS score of 4.3 the issue is considered moderate but still measurable; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only authenticated access with Contributor or higher privileges and send a request to the AJAX endpoint; no special local conditions or exploits are required. The impact is limited to confidentiality loss of unpublished post content; however, if an attacker gains broader privileges the exposure could be significant.