The Secure Custom Fields WordPress plugin fails to perform a proper read permission check when rendering relational fields. As a result, users with Contributor or higher permissions can view the titles and unpublished status metadata of posts created by other users, leaking information that should remain private.

All installations of Secure Custom Fields earlier than version 6.9.8, regardless of vendor, are affected. The vulnerability applies to the standard WordPress configuration where Contributors and above can edit posts.

The vulnerability requires authenticated access, specifically a user with Contributor or higher privilege on a WordPress site. Because it allows the disclosure of internal post metadata, it facilitates an attacker’s reconnaissance of unpublished content. No EPSS or KEV data is available, and a CVSS score has not been published. The risk is primarily information disclosure rather than direct code execution or widespread disruption.