[ CVE-2026-93507 · Published 23 Sep 2026 ]
Vulnerability in Unknown WC Fields Factory
CVSS 3.3
EPSS <1%No fix listed yet
[ Description ]Official description
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.