{
 "id": "WPSEC-2026-2995",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2995/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2995/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2995/index.md",
 "title": "Custom Post Types and Custom Fields creator – WCK <= 2.4.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Meta Modification",
 "description": "The WCK plugin for WordPress is vulnerable to unauthorized modification of data via the add, update, remove and reorder meta AJAX actions in all versions up to, and including, 2.4.0, due to an insufficient capability check in wck_verify_user_capabilities(). The function only checks the generic 'edit_posts' capability and post authorship. It does not check the post's type or status, or that the submitted meta name belongs to the meta box handling the request. Submitted value keys are also stored as separate post meta names. This makes it possible for authenticated attackers, with Contributor-level access and above, to write arbitrary post meta keys, including protected ones, to posts they authored, including published posts they can no longer edit.",
 "plugin": {
  "slug": "wck-custom-fields-and-custom-post-types-creator",
  "name": "Custom Post Types and Custom Fields creator – WCK",
  "full_name": "Custom Post Types and Custom Fields creator – WCK",
  "wordpress_org": "https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wck-custom-fields-and-custom-post-types-creator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wck-custom-fields-and-custom-post-types-creator"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.1",
 "remediation": "Update to 2.4.1 or later.",
 "fix_released": "2026-11-10T08:51:06+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:15:37.489786+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2995/",
  "https://plugins.svn.wordpress.org/wck-custom-fields-and-custom-post-types-creator/tags/2.4.1/",
  "https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wck-custom-fields-and-custom-post-types-creator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}