Threats tagged 'ghsa-2j9h-chv5-8537'

A vulnerability in the Secure Custom Fields WordPress plugin before version 6.9.8 allows users with contributor-level access and above to modify bidirectional relationship references on posts, users, or terms they normally cannot edit. This occurs because the plugin does not verify user permissions before writing to the target object during synchronization.