EUVD-2026-120899

Custom Post Types and Custom Fields creator WCK before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wckshowupdateform AJAX handler, which lacks the...