Bug 2569528 (CVE-2026-125745)

Summary: CVE-2026-125745 wck-custom-fields-and-custom-post-types-creator: wck-custom-fields-and-custom-post-types-creator: Information disclosure via missing authorization checks
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Custom Post Types and Custom Fields creator (WCK) plugin. This vulnerability allows an authenticated attacker to cause an information disclosure, exposing private post data and custom field values belonging to other users. The issue occurs because the plugin's update form request handler lacks proper authorization and capability checks. By submitting a crafted request referencing an arbitrary post identifier, a logged-in user can access metadata and draft content they are not authorized to view.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 13:00:38 UTC 
Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data.