Description An improper access check allows unauthorized users to create custom fields via webservices endpoints. Remediation References CVE-2026-48958 Related Vulnerabilities Werkzeug WSGI Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-34069) WordPress Plugin Page Showcaser Boxes Cross-Site Scripting (1.1) WordPress Plugin AutomatorWP-The most flexible and powerful no-code automation for WordPress Cross-Site Request Forgery (2.5.8) WordPress Plugin I Recommend This SQL Injection (3.7.7) TCExam Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2020-5744) Severity High Classification CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Tags Missing Update Known Vulnerabilities CVE-2026-48958