CVE-2026-93507: Unknown Wc Fields Factory

Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days.

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

Affected products

• Unknown Wc Fields Factory: before 4.1.11 (fixed in 4.1.11)

Published 2026-09-23. Last modified 2026-09-23.