CVE-2026-125745: WCK before 2.4.1 Missing Authorization via wck_show_update_form AJAX
Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wckshowupdateform AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Custom Post Types and Custom Fields creator (WCK)to a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker needs access to any WCK meta box and a valid wck-edit-entry nonce. The attacker does not need permission to edit the post whose custom-field values are requested.
What information can be exposed?
A crafted admin-ajax.php request can disclose custom-field values for an arbitrary post ID and target meta key. This can include post-meta or option values associated with other users' private or draft posts.
Are unauthenticated visitors affected?
The described attack requires authentication, access to a WCK meta box, and a valid nonce. The available information does not indicate that unauthenticated visitors can exploit it.
Which versions are affected?
WCK versions before 2.4.1 are affected. Upgrading to 2.4.1 or later addresses the stated affected-version range.