Skip to content
Sign in
8.1 High

CVE-2026-93508 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX…

Description

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.

Affected products and versions

Product Affected versions Fixed in
WC Fields Factory 4.1 earliest → < 4.1.11 4.1.11

Other CVEs of WC Fields Factory

The 3 CVEs of WC Fields Factory →
CVE-2026-93507 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a… 3.3 Low CVE-2023-0277 The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it… 7.2 High
Track this CVE