rootpwn

low · CVSS v3 3.3 · EPSS 0.0018

CVE-2026-93507

The WC Fields Factory WordPress plugin (v4.1.10 and earlier) fails to enforce proper access checks or nonce verification for post-cloning ac

Overview

The WC Fields Factory WordPress plugin (v4.1.10 and earlier) fails to enforce proper access checks or nonce verification for post-cloning actions. This flaw allows users with Contributor or higher roles to duplicate any post, including private or draft content, and read the resulting copy. The vulnerability exposes sensitive content to unauthorized contributors.

Description

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

Impact

Confidentiality is compromised as private or draft posts can be duplicated and read by contributors. The integrity of content ownership is weakened because the original author’s control over their posts is bypassed. Site administrators and content owners are directly impacted.

Remediation

1. Upgrade the WC Fields Factory plugin to version 4.1.11 or later, where the access check and nonce validation are fixed. 2. If an upgrade is not immediately possible, temporarily revoke Contributor role permissions for post cloning or disable the cloning feature via plugin settings or custom code. 3. Verify that role capabilities are correctly configured and monitor audit logs for unexpected post duplication activity.

Risk context

Severity is low (CVSS 3.3) and EPSS is 0.0018, indicating a very low probability of exploitation. However, the impact on confidentiality for private or draft content warrants timely remediation.

Affected products

  • WC Fields Factory WordPress plugin

Scores

Severity
low
CVSS v2
3.2
CVSS v3
3.3
CVSS v4
—
EPSS
0.0018

wordpress plugin post-cloning confidentiality role-based-access low-severity CVE-2026-93507

← All CVEs

Related CVEs

low

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

View analysis

low

CVE-2026-87069

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.

View analysis

low

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

View analysis

low

CVE-2026-93528

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.

View analysis