Threats tagged 'ghsa-g6hq-r9gh-7r48'

The Secure Custom Fields WordPress plugin versions before 6.9.8 lack a read-permission check when rendering and formatting relational field values. This flaw allows users with post-editing privileges (Contributor role and above) to view titles and non-public statuses of unpublished posts owned by other users.