{"id":"CVE-2026-125745","kind":"vulnerability","aliases":["CVE-2026-125745"],"related":[],"title":"WCK WordPress plugin: authenticated users can read private post custom fields","description":"Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data.","summary":"The WCK plugin for WordPress before 2.4.1 has an AJAX handler that skips capability checks, so a logged-in user can read custom-field values on posts they cannot edit. An attacker can read private or draft post data and other users' sensitive post-meta or option values.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wck","wordpress"],"not_affected_if":["no-wck-meta-boxes","plugin-updated"],"how_to_check":"- Check the installed WCK (Custom Post Types and Custom Fields creator) plugin version in the WordPress admin under Plugins.\n- Look for the `wck_show_update_form` AJAX action in the plugin code.","fix":"- Move the WCK plugin to version `2.4.1` or later.","status":"open","published_at":"2026-11-10T13:18:23+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","triaged_at":"2026-11-10T13:23:34+00:00","updated_at":"2026-11-10T13:23:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T13:23:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move the WCK plugin to version `2.4.1` or later.","reach":"internet","title":"WCK WordPress plugin: authenticated users can read private post custom fields","impact":"medium","summary":"The WCK plugin for WordPress before 2.4.1 has an AJAX handler that skips capability checks, so a logged-in user can read custom-field values on posts they cannot edit. An attacker can read private or draft post data and other users' sensitive post-meta or option values.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wck","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in users read private post custom fields and options","analyst_note":"","how_to_check":"- Check the installed WCK (Custom Post Types and Custom Fields creator) plugin version in the WordPress admin under Plugins.\n- Look for the `wck_show_update_form` AJAX action in the plugin code.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-updated","no-wck-meta-boxes"],"who_is_affected":"Sites running the WCK plugin before 2.4.1 where users with some account access can reach WCK meta boxes. The sources do not describe whether sites without public user registration are safe, so treat any site with logged-in contributors or subscribers as exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4695,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125745':14A,17A '-2026':13A,16A '2.4.1':30B,84C 'access':95C 'action':139C 'admin-ajax.php':145C 'ajax':33B,119C 'allow':91C 'arbitrari':161C 'attack':57B,93C,140C 'authent':4A,92C 'author':88C 'belong':173C 'box':100C 'cannot':54B,110C 'capabl':37B,124C 'check':38B,125C 'contain':85C 'craft':144C 'creator':81C 'custom':10A,48B,75C,79C,104C 'custom-field':47B,103C 'cve':12A,15A 'data':64B,182C 'disclos':165C 'draft':62B,180C 'edit':55B,111C,152C 'enforc':126C 'entri':153C 'exploit':113C 'field':11A,49B,80C,105C 'form':118C 'handler':34B,120C,129C 'host':21B 'id':163C 'includ':177C 'key':158C 'lack':122C 'log':42B 'logged-in':41B 'meta':71B,99C,157C,169C 'miss':87C 'non':136C 'non-uniqu':135C 'nonc':138C,154C 'option':73B,171C 'packag':18B 'plugin':3A,26B 'post':9A,52B,63B,70B,76C,108C,162C,168C,181C 'post-meta':69B,167C 'privat':8A,60B,178C 'read':7A,46B,59B,102C 'reli':131C 'request':146C 'self':20B 'self-host':19B 'send':142C 'sensit':68B,166C 'share':134C 'show':116C 'skip':36B 'target':156C 'type':77C 'uniqu':137C 'updat':117C 'user':5A,44B,67B,176C 'valid':149C 'valu':50B,74B,106C,172C 'vulner':89C 'wck':1A,22B,25B,82C,98C,115C,151C 'wck-edit-entri':150C 'wordpress':2A,23B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WCK plugin before 2.4.1 where users with some account access can reach WCK meta boxes. The sources do not describe whether sites without public user registration are safe, so treat any site with logged-in contributors or subscribers as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wck","wordpress"],"campaign_type":null,"search_a":"'-125745':14A,17A '-2026':13A,16A 'authent':4A 'custom':10A 'cve':12A,15A 'field':11A 'plugin':3A 'post':9A 'privat':8A 'read':7A 'user':5A 'wck':1A 'wordpress':2A","search_b":"'2.4.1':30B 'ajax':33B 'attack':57B 'cannot':54B 'capabl':37B 'check':38B 'custom':48B 'custom-field':47B 'data':64B 'draft':62B 'edit':55B 'field':49B 'handler':34B 'host':21B 'log':42B 'logged-in':41B 'meta':71B 'option':73B 'packag':18B 'plugin':26B 'post':52B,63B,70B 'post-meta':69B 'privat':60B 'read':46B,59B 'self':20B 'self-host':19B 'sensit':68B 'skip':36B 'user':44B,67B 'valu':50B,74B 'wck':22B,25B 'wordpress':23B,28B","search_c":"'2.4.1':84C 'access':95C 'action':139C 'admin-ajax.php':145C 'ajax':119C 'allow':91C 'arbitrari':161C 'attack':93C,140C 'authent':92C 'author':88C 'belong':173C 'box':100C 'cannot':110C 'capabl':124C 'check':125C 'contain':85C 'craft':144C 'creator':81C 'custom':75C,79C,104C 'custom-field':103C 'data':182C 'disclos':165C 'draft':180C 'edit':111C,152C 'enforc':126C 'entri':153C 'exploit':113C 'field':80C,105C 'form':118C 'handler':120C,129C 'id':163C 'includ':177C 'key':158C 'lack':122C 'meta':99C,157C,169C 'miss':87C 'non':136C 'non-uniqu':135C 'nonc':138C,154C 'option':171C 'post':76C,108C,162C,168C,181C 'post-meta':167C 'privat':178C 'read':102C 'reli':131C 'request':146C 'send':142C 'sensit':166C 'share':134C 'show':116C 'target':156C 'type':77C 'uniqu':137C 'updat':117C 'user':176C 'valid':149C 'valu':106C,172C 'vulner':89C 'wck':82C,98C,115C,151C 'wck-edit-entri':150C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T13:18:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125745","severity":null,"published_at":"2026-11-10T13:18:23+00:00","modified_at":"2026-11-10T13:18:23+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","fetched_at":"2026-11-10T13:22:03+00:00","note":null}],"documents":[{"id":115153,"url":"https://www.vulncheck.com/advisories/wck-before-missing-authorization-via-wck-show-update-form-ajax","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}