Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-93507: WC Fields Factory plugin lets contributors copy any post
CVE-2026-93507 · published 1 month ago
Summary
The WC Fields Factory add-on for WordPress allows users with a contributor role to make copies of any article, including drafts and private content owned by other users. This means they can see and reuse information that should stay hidden. Update the plugin to the latest version or limit contributor permissions to stop this behavior.
What to do
- Update unknown wc fields factory to version 4.1.11 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wc fields factory | < 4.1.11 |
Original advisory text
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.3
Low
Type
CWE-862Missing Authorization
Timeline
Published23 Sep 2026
Updated29 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta