CVE-2024-1995 identifies a missing authorization vulnerability in the Smart Custom Fields plugin for WordPress, specifically in the relational_posts_search() function. This flaw allows authenticated users with at least subscriber privileges to bypass intended access controls and retrieve content from posts that are password protected or marked private. The vulnerability affects all versions up to and including 4.2.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction, resulting in limited confidentiality impact without affecting integrity or availability.

Authenticated users with subscriber-level access or higher can retrieve sensitive post content that should be restricted, such as password-protected or private posts. This could lead to unauthorized disclosure of confidential information within the WordPress site. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber-level access or disabling the Smart Custom Fields plugin if sensitive content exposure is a concern.