Secure Custom Fields
Secure Custom Fields has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Incorrect Authorization, behind 1 of the records (100%).
The one issue recorded for Secure Custom Fields has a vendor fix available, so running the current release closes it.
All of these findings were reported by Charles Vosburgh. Secure Custom Fields is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.2.
CVE-2026-92403Secure Custom Fields <= 6.9.3 - Missing Authorization
Read the full analysisVulnerability Records

Secure Custom Fields
Author
WordPress.org
Secure Custom Fields (SCF) extends WordPress’s capabilities, transforming it into a flexible content management tool. With SCF, managing custom data becomes straightforward and efficient. Easily create fields on demand. The SCF builder makes it easy to add fields to WordPress edit screens, whether you’re adding a new “ingredients” field to a recipe or designing complex metadata for a specialized site. Flexibility in placement. Fields can be applied throughout WordPress—posts, pages, users, taxonomy terms, media, comments, and even custom options pages—organizing your data how you want. Display seamlessly. Using SCF functions, you can display custom field data in your templates, making content integration easy for all levels of developers. A comprehensive content management solution. Beyond custom fields, SCF allows you to register new post types and taxonomies directly from the SCF interface, providing more control without needing additional plugins or custom code. Accessible and user-friendly design. The field interface aligns with WordPress’s native design, creating an experience that’s both accessible and easy for content creators to use. Installing this plugin will deactivate plugins with matching function names/functionality, specifically Advanced Custom Fields, Advanced Custom Fields Pro, and the legacy Secure Custom Fields plugins, to avoid code errors (this is the same behavior as ACF Pro). Read more about Secure Custom Fields at developer.wordpress.org/secure-custom-fields. Features Clear and easy-to-use setup Robust functions for content management Over 30 Field Types
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C