Smart Custom Fields Vulnerability – Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure – CVE-2024-1995 | WordPress Plugin Vulnerability Report

Plugin Name: Smart Custom Fields

Key Information:

  • Software Type: Plugin
  • Software Slug: smart-custom-fields
  • Software Status: Active
  • Software Author: inc2734
  • Software Downloads: 224,550
  • Active Installs: 50,000
  • Last Updated: March 19, 2024
  • Patched Versions: 5.0.0
  • Affected Versions: <= 4.2.2

Vulnerability Details:

  • Name: Smart Custom Fields <= 4.2.2
  • Title: Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE: CVE-2024-1995
  • CVSS Score: 4.3
  • Publicly Published: March 19, 2024
  • Researcher: Lucio Sà
  • Description: The Smart Custom Fields plugin for WordPress contains a vulnerability in versions up to and including 4.2.2, where a missing capability check in the relational_posts_search() function allows authenticated users with subscriber-level access or higher to view content from password-protected and private posts.


The Smart Custom Fields plugin, widely utilized for adding custom fields to WordPress sites, was found to have a significant security flaw in versions up to 4.2.2, identified as CVE-2024-1995. This vulnerability allowed authenticated users with minimal permissions to bypass content restrictions and access sensitive post content. The issue has been resolved in the latest update, version 5.0.0.

Detailed Overview:

Discovered by researcher Lucio Sà, this vulnerability highlights a critical oversight in the plugin's security mechanisms. By failing to properly check user capabilities within the relational_posts_search() function, the plugin inadvertently exposed password-protected and private posts to unauthorized users. This breach not only posed a risk to data confidentiality but also emphasized the need for rigorous security practices in plugin development.

Advice for Users:

  • Immediate Action: Users of the Smart Custom Fields plugin should immediately upgrade to version 5.0.0 to mitigate the risk posed by CVE-2024-1995.
  • Check for Signs of Vulnerability: Site administrators are advised to review access logs for unusual activity that might indicate exploitation of this vulnerability and to audit the visibility settings of sensitive content.
  • Alternate Plugins: While the vulnerability has been patched, users may consider evaluating other custom field plugins as alternatives to ensure a diverse and secure plugin ecosystem on their sites.
  • Stay Updated: Maintaining the latest versions of all WordPress plugins is crucial for site security. Users should regularly check for updates and apply them promptly to protect against known vulnerabilities.


The swift resolution of CVE-2024-1995 in the Smart Custom Fields plugin serves as a vital reminder of the ongoing challenges in maintaining web security. For WordPress site owners, particularly those managing sensitive content, staying vigilant and proactive in updating plugins is essential for safeguarding their digital assets. As the digital landscape continues to evolve, the commitment to security by both developers and users remains paramount in ensuring the integrity and trustworthiness of online platforms.


Detailed Report: 

In the dynamic world of WordPress, where plugins like Smart Custom Fields empower users to tailor their digital spaces with custom functionality, the recent discovery of CVE-2024-1995 serves as a critical wake-up call. This vulnerability within the Smart Custom Fields plugin, a tool cherished for its ability to add nuanced detail to WordPress sites, revealed a significant security gap that could potentially expose sensitive content to unauthorized eyes. The revelation of such a flaw not only underscores the inherent risks in digital customization but also highlights the paramount importance of vigilance and timely updates in safeguarding one's digital presence.

Smart Custom Fields: Enhancing WordPress Functionality

Smart Custom Fields, developed by inc2734, stands out for its robust capability to extend WordPress sites with customizable fields, allowing for a tailored user experience. With over 224,550 downloads and 50,000 active installations, its impact on the WordPress community is undeniable. However, the trust placed in this plugin was tested with the discovery of a vulnerability in versions up to and including 4.2.2, prompting an immediate response from the development team.

CVE-2024-1995: A Closer Look

The vulnerability, identified as CVE-2024-1995, stemmed from a missing capability check within the relational_posts_search() function, leading to unauthorized post content disclosure. This flaw meant that individuals with as little as subscriber-level access could potentially view content meant to be private or password-protected, breaching the privacy and security of WordPress sites utilizing the plugin. Unearthed by researcher Lucio Sà, this issue was promptly made public on March 19, 2024, signaling the need for immediate corrective action.

Risks and Implications

The implications of CVE-2024-1995 extend beyond simple unauthorized access; they encompass potential data breaches, undermining of user trust, and the jeopardization of site integrity. For small business owners, whose digital presence is often a primary touchpoint with customers, such vulnerabilities can translate to tangible business risks, including reputational damage and loss of customer confidence.

Remediation and Proactive Defense

In response to the discovery of CVE-2024-1995, a patched version of the plugin, 5.0.0, was swiftly released, addressing the vulnerability and restoring security. Site owners are urged to update their Smart Custom Fields plugin to this latest version to protect their sites from potential exploitation. Moreover, regular monitoring of plugin updates, vigilant management of user permissions, and a proactive stance on website security are instrumental in defending against such vulnerabilities.

Navigating Past Vulnerabilities

CVE-2024-1995 is not the first challenge faced by the Smart Custom Fields plugin, with previous vulnerabilities also having been addressed by the developers. These instances serve as a reminder of the ongoing battle against digital threats and the necessity for continuous improvement in security practices.

The Critical Nature of Security Awareness

For small business owners juggling myriad responsibilities, the task of staying abreast of every security update may seem daunting. Yet, in an era where digital footprints are increasingly synonymous with business identities, the importance of maintaining a secure website cannot be overstated. The incident involving CVE-2024-1995 in the Smart Custom Fields plugin reinforces the crucial need for regular updates, diligent security practices, and an informed approach to plugin management. By prioritizing these practices, small business owners can not only protect their digital assets but also fortify the trust and confidence of their clientele in an ever-evolving digital landscape.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Smart Custom Fields Vulnerability – Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure – CVE-2024-1995 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment