The Secure Custom Fields WordPress plugin fails to verify that a user has permission to modify the target object during bidirectional relationship synchronization. Contributors or higher-level users can add or remove references of their own objects on arbitrary posts, users, or terms that they normally cannot edit. This permits an attacker to defectively associate content or users, potentially leading to defacement, privacy violations, or prolonged persistence by misleading or corrupting link data.

WordPress sites running the Secure Custom Fields plugin on any version before 6.9.8 are affected. The vulnerability is present in all editions of the plugin regardless of vendor details, as the issue is tied to the plugin’s internal relationship handling logic.

The flaw represents an Insecure Direct Object Reference; an attacker needs only contributor-level access or above to exploit it, provided they know or can guess the object identifiers. No CVSS score is published and EPSS is not available, so the exact severity and likelihood are uncertain. Because the vulnerability is not listed in the CISA KEV catalog and no public exploits are known, the current attack surface is moderate, but the potential for unauthorized data manipulation is significant.