CVE-2026-93508

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11

Description Insufficient access restrictions on the field-management AJAX action allow authenticated users with Subscriber-level permissions or higher to create, modify, and delete arbitrary post meta on any post. This includes WooCommerce products, regardless of who owns them. An attacker can use this to manipulate stored pricing rules on a product to lower its price during checkout.

Recommendations Update WC Fields Factory WordPress plugin to version 4.1.11 or later.