Custom Post Types and Custom Fields creator – WCK <= 2.4.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Meta Modification
- ID
- WPSEC-2026-2995
- Plugin
- Custom Post Types and Custom Fields creator – WCK (wck-custom-fields-and-custom-post-types-creator)
- Affected
- all versions before 2.4.1
- Remediation
- Update to 2.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Custom Post Types and Custom Fields creator – WCK on WPSec AttackSurface
- Fix released
- Published
Description
The WCK plugin for WordPress is vulnerable to unauthorized modification of data via the add, update, remove and reorder meta AJAX actions in all versions up to, and including, 2.4.0, due to an insufficient capability check in wck_verify_user_capabilities(). The function only checks the generic 'edit_posts' capability and post authorship. It does not check the post's type or status, or that the submitted meta name belongs to the meta box handling the request. Submitted value keys are also stored as separate post meta names. This makes it possible for authenticated attackers, with Contributor-level access and above, to write arbitrary post meta keys, including protected ones, to posts they authored, including published posts they can no longer edit.
References
- https://wpsec.com/vuln/WPSEC-2026-2995/
- https://plugins.svn.wordpress.org/wck-custom-fields-and-custom-post-types-creator/tags/2.4.1/
- https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS