# Custom Post Types and Custom Fields creator – WCK <= 2.4.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Meta Modification

- **ID:** WPSEC-2026-2995
- **Plugin:** Custom Post Types and Custom Fields creator – WCK (`wck-custom-fields-and-custom-post-types-creator`), https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/
- **Affected versions:** all versions before 2.4.1
- **Fixed in:** 2.4.1 (Update to 2.4.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wck-custom-fields-and-custom-post-types-creator
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2995/

## Description

The WCK plugin for WordPress is vulnerable to unauthorized modification of data via the add, update, remove and reorder meta AJAX actions in all versions up to, and including, 2.4.0, due to an insufficient capability check in wck_verify_user_capabilities(). The function only checks the generic 'edit_posts' capability and post authorship. It does not check the post's type or status, or that the submitted meta name belongs to the meta box handling the request. Submitted value keys are also stored as separate post meta names. This makes it possible for authenticated attackers, with Contributor-level access and above, to write arbitrary post meta keys, including protected ones, to posts they authored, including published posts they can no longer edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-2995/
- https://plugins.svn.wordpress.org/wck-custom-fields-and-custom-post-types-creator/tags/2.4.1/
- https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2995/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.