Skip to content
Sign in
3.3 Low

CVE-2026-93507 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a…

Description

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

Affected products and versions

Product Affected versions Fixed in
WC Fields Factory 4.1 earliest → < 4.1.11 4.1.11

Other CVEs of WC Fields Factory

The 3 CVEs of WC Fields Factory →
CVE-2026-93508 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX… 8.1 High CVE-2023-0277 The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it… 7.2 High
Track this CVE