Threats tagged 'ghsa-4q3w-g67r-f2wf'

Custom Post Types and Custom Fields creator (WCK) versions before 2.4.1 have a missing authorization vulnerability. Authenticated users with access to any WCK meta box can exploit the wck_show_update_form AJAX handler, which lacks proper capability checks and uses a shared, non-unique nonce action. This allows attackers to read custom-field values on posts they cannot edit by sending crafted requests to admin-ajax.php, potentially disclosing sensitive post-meta or option data including private or draft posts.