CVE-2026-93507

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11

Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary posts of any type or status. This includes the ability to clone private or draft content belonging to other users, granting the attacker read access to the duplicated copy. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that a request was intentionally sent by the user.

Recommendations Update the WC Fields Factory WordPress plugin to version 4.1.11 or later.