CVE-2026-93508: WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WC Fields Factory WordPress pluginto a version that resolves this vulnerability.Fixed in 4.1.11
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated account with Subscriber-level access or higher can exploit the vulnerable AJAX field-management action. The attacker does not need to own the affected post or WooCommerce product.
What can an attacker change?
An attacker can create, modify, or delete arbitrary post metadata on any post, including WooCommerce products. They can also alter stored product pricing rules to reduce the price charged at checkout.
Are WooCommerce stores particularly exposed?
Yes. Stores using affected versions may have product metadata and stored pricing rules modified by low-privileged authenticated users, potentially allowing checkout-price manipulation.
What should be prioritized for remediation?
Update WC Fields Factory to version 4.1.11 or later. Until updating, restrict or remove Subscriber-level and other low-privileged accounts where possible, and review product metadata and pricing rules for unauthorized changes.