The Secure Custom Fields WordPress plugin, versions earlier than 6.9.8, fails to re‑apply field‑group location rules when saving custom field values via the post editor. As a result, users with contributor privileges or higher can create or modify custom fields that the plugin reserves for administrators, effectively allowing them to override site‑wide configuration stored in those fields. This unauthorized write leads to a loss of integrity for the protected configuration, enabling unintended data exposure or manipulation of site behavior.

Any WordPress installation running the Secure Custom Fields plugin before version 6.9.8 is affected. The vulnerability is specific to this plugin; no other component is mentioned. Sites that rely on Secure Custom Fields for content or configuration should verify their plugin version and apply a fix if necessary.

There is no EPSS score or KEV listing, but the CVE description indicates the issue can be triggered by normal post‑editing actions performed by contributor users. Because the vulnerability permits direct writes to administrator‑reserved fields without additional authorization checks, the risk is high in terms of potential impact. The lack of exploitation data in public metrics suggests that the vulnerability is not yet actively used in the wild, yet the intrinsic severity warrants immediate attention.