CVE-2026-93507

Published: Sep 23, 2026Modified: Sep 23, 2026Deferred

3.3

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Exploitability: 0.7 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://wpscan.com/vulnerability/21569537-3a83-4df1-a6c2-8ca720e71586/

Source: contact@wpscan.com

Timeline

No history available yet.