Access Control Vulnerability in WC Fields Factory WordPress Plugin
CVE-2026-93507
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-93507?
The WC Fields Factory plugin for WordPress prior to version 4.1.11 contains a flaw that allows contributors and higher-level users to bypass restrictions on post cloning. The plugin lacks adequate nonce verification for the cloning action, enabling unauthorized users to duplicate any posts, including private and draft content authored by other users. This vulnerability poses significant privacy risks and could lead to unauthorized access to sensitive information.
Affected Version(s)
WC Fields Factory 0 < 4.1.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.