Security Alert Summary
The WC Fields Factory WordPress plugin before 4.1.11 fails to properly restrict a post-cloning action and does not verify a nonce, which allows users with Contributor-level privileges and above to duplicate arbitrary posts of any type or status. This can expose copies of private or draft content and grant read access to those copies.
CVE Details
- CVE ID:
CVE-2026-93507 - Affected Component: WC Fields Factory WordPress plugin
- Affected Versions: Versions before 4.1.11
- Published: September 23, 2026 at 6:17:05 AM UTC
- Last Modified: September 23, 2026 at 11:17:17 AM UTC
- CVSS v3.1 Base Score: 3.3 (LOW)
- CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
- Authentication / Privileges / User Interaction: Attack Vector: Network; Attack Complexity: High; Privileges Required: High; User Interaction: None
- Impact (CIA): Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The plugin does not properly restrict access to, or verify a nonce for, a post-cloning action. Because authorization checks and nonce verification are missing or insufficient for this action, users with Contributor-level privileges and above can trigger the clone operation. The vulnerability allows duplication of arbitrary posts of any type or status, including private and draft content. The duplicated copy is created with read access for the actor, exposing content that the actor could not read in its original state. The description does not name specific functions or REST endpoints, so no function names are asserted here.
How This Could Impact Your Website
Consider a small editorial team where the site owner manages permissions, an internal editor creates and schedules posts, and external contractors contribute content. A contractor or contributor account with sufficient privileges could clone another user’s private or draft posts and obtain read access to those copies. This could expose internal drafts or user-posted private content to users who should not see it. Exposed content can increase the risk of targeted phishing or social engineering against staff members whose email addresses or draft content are revealed. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase attack surface.
- Monitor site activity and audit logs for unusual cloning or content duplication actions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
