CVE-2026-125745: madalinungureanu Custom Post Types and Custom Fields creator – WCK: Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that…

Custom Post Types and Custom Fields creator WCK before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wckshowupdateform AJAX handler, which lacks the...