low3.3
CVE-2026-93507
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-l…
Impact
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Affected products
| Product | Affected versions |
|---|---|
| WC Fields Factory WordPress Plugin | before 4.1.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.