Missing Authorization Vulnerability in WCK Custom Post Types and Fields Creator
CVE-2026-125745

2.3LOW

Key Information:

Vendor

Madalinungureanu

Status
Custom Post Types And Custom Fields Creator – Wck
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125745?

The WCK Custom Post Types and Custom Fields Creator before version 2.4.1 has a missing authorization flaw that allows authenticated attackers to access custom field values on posts they don't have permission to edit. By exploiting the vulnerable wck_show_update_form AJAX handler, attackers can craft requests to admin-ajax.php using a valid nonce. This vulnerability can lead to the exposure of sensitive metadata of other users' posts, including those that are private or in draft status.

Affected Version(s)

Custom Post Types and Custom Fields creator – WCK 0 < 2.4.1

References

https://wordpress.org/plugins/wck-custom-fields-and-custo...
patchrelease-notes
https://www.vulncheck.com/advisories/wck-before-missing-a...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

buiih
.