WC Fields Factory, CVE-2026-93507

CVE, Research URL: CVE-2026-93507
Home page URL: Security reports for WC Fields Factory
Application: WC Fields Factory
Published on: Sep 23, 2026
Research Description: WC Fields Factory [wc-fields-factory] < 4.1.11 CVE-2026-93507 [en] The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Affected versions: max 4.1.11.
Status: vulnerable