CVE-2026-93507: WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WC Fields Factory WordPress pluginto a version that resolves this vulnerability.Fixed in 4.1.11
Event History
Frequently Asked Questions
Who can exploit this issue?
A WordPress user with a Contributor-level account or higher can exploit it. Unauthenticated visitors are not described as being able to use the vulnerable cloning action.
What access does an attacker gain through post cloning?
The attacker can duplicate arbitrary posts regardless of type or status, including private and draft posts owned by other users. They can then read the content in the cloned post.
What must an attacker do to exploit it?
They need an authenticated WordPress account with at least Contributor privileges and access to the vulnerable post-cloning action. The issue is caused by insufficient access restriction and missing nonce verification for that action.
Which plugin versions are affected?
WC Fields Factory versions before 4.1.11 are affected. Updating to version 4.1.11 or later addresses the identified vulnerable version range.