Security Alert Summary
The WC Fields Factory WordPress plugin prior to version 4.1.11 contains an access control flaw in a field-management AJAX action. Authenticated users with Subscriber-level access and above can create, modify, and delete arbitrary post meta on any post, including WooCommerce products, and can manipulate stored pricing rules to reduce product checkout prices.
CVE Details
- CVE ID:
CVE-2026-93508 - Affected component: WC Fields Factory WordPress plugin
- Affected versions: Versions before 4.1.11
- Published: September 23, 2026 at 06:17:05 AM UTC
- Last modified: September 23, 2026 at 11:17:17 AM UTC
- CVSS v3.1: Base score 8.1, Severity HIGH, Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Authentication / privileges / user interaction: Requires an authenticated user with low privileges (PR:L). User interaction is not required (UI:N).
- Primary impact: Confidentiality: High; Integrity: High; Availability: None
- CWE: CWE-862 (Missing Authorization)
Technical Details
The vulnerability stems from insufficient access control on the plugin’s field-management AJAX action. Because the action does not properly restrict who may invoke it or which resources they may modify, authenticated users with Subscriber-level access and higher can perform operations that should be limited to privileged roles.
Specifically, the flaw allows these users to create, modify, and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership. The description also notes that stored pricing rules on a product can be manipulated to reduce its checkout price. The issue is an authorization failure (CWE-862) rather than an input validation or sanitization error.
How This Could Impact Your Website
Consider a multi-user WordPress site where the site owner manages overall configuration, internal staff manage content, and external contractors or contributors are granted Subscriber or Contributor accounts. An attacker who has or obtains a Subscriber-level account could exploit this vulnerability to alter post meta on products or other posts they do not own.
Practical consequences include exposure or modification of product pricing and associated metadata, which could lead to incorrect prices at checkout. The ability to modify post meta might also expose internal data such as user-related metadata or product configuration details. Such information could increase the risk of targeted phishing or social engineering against staff whose email addresses or roles are discoverable from site data.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Subscriber and Contributor privileges where not required.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to product metadata or price changes.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
