CVE-2026-93507: WC Fields Factory Auth Bypass Vulnerability

CVE-2026-93507 Overview

CVE-2026-93507 affects the WC Fields Factory WordPress plugin in versions prior to 4.1.11. The plugin fails to restrict access to a post-cloning action and does not verify a nonce for the request. Authenticated users with Contributor-level privileges or higher can duplicate arbitrary posts of any type or status. Attackers gain read access to the cloned copies, exposing other users' private or draft content. The flaw is classified as Missing Authorization [CWE-862].

Critical Impact
Contributor-level accounts can duplicate and read private or draft posts belonging to other users, leaking otherwise restricted content across the WordPress site.

Affected Products

WC Fields Factory WordPress plugin versions before 4.1.11
WordPress sites running WooCommerce with the vulnerable plugin installed
Multi-author or membership WordPress environments where Contributor+ roles exist

Discovery Timeline

2026-09-23 - CVE-2026-93507 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93507

Vulnerability Analysis

The WC Fields Factory plugin exposes a post-cloning action intended for administrative content management. The handler neither performs a capability check appropriate to the action nor validates a WordPress nonce. Any authenticated user with the Contributor role or higher can invoke the action and duplicate arbitrary posts. The duplicated post is then accessible to the invoking user, granting read access to content the user was never authorized to view. This includes private posts, drafts, and posts of custom types owned by other authors. The behavior violates the principle of least privilege in the WordPress role and capability model.

Root Cause

The root cause is Missing Authorization [CWE-862] in the plugin's clone handler. The handler assumes the caller is a trusted administrator without verifying either the WordPress capability required to read the source post or a nonce token bound to the requesting user. Without these checks, any authenticated session with a Contributor role satisfies the handler's implicit trust boundary.

Attack Vector

Exploitation requires an authenticated Contributor, Author, Editor, or higher account. The attacker submits a request to the plugin's clone endpoint referencing the target post identifier. The plugin creates a duplicate owned by or readable to the attacker. The attacker then reads the cloned post through the standard WordPress interface. No user interaction from the victim is required. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-93507

Indicators of Compromise

Unexpected duplicate posts appearing in wp_posts with authorship or ownership mismatched against the original
HTTP requests to the WC Fields Factory clone action originating from non-administrator sessions
Access log entries showing Contributor-level users triggering plugin admin-ajax or admin-post endpoints
Newly created draft or private posts whose content mirrors existing restricted posts

Detection Strategies

Audit the WordPress database for posts with identical or near-identical post_content values across different authors
Enable WordPress activity logging to record post creation events and correlate them with the invoking user role
Alert on any request to plugin clone endpoints where the session role is below Editor or Administrator

Monitoring Recommendations

Monitor web server access logs for requests to admin-ajax.php or admin-post.php containing WC Fields Factory clone action parameters
Track post creation velocity per user account and flag Contributor accounts that generate unusual duplication activity
Review the plugin version reported by WordPress site health and alert when installed versions fall below 4.1.11

How to Mitigate CVE-2026-93507

Immediate Actions Required

Update the WC Fields Factory plugin to version 4.1.11 or later on every affected WordPress site
Audit existing Contributor, Author, and Editor accounts and remove inactive or unnecessary users
Review recently created posts for evidence of unauthorized duplication and remove exposed copies

Patch Information

The vendor released version 4.1.11 of WC Fields Factory to address the missing authorization and nonce verification in the post-cloning action. Administrators should install this update through the WordPress plugin dashboard or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the WC Fields Factory plugin until the patched version can be installed
Restrict Contributor and Author role assignments and temporarily downgrade non-essential accounts to Subscriber
Deploy a web application firewall rule that blocks unauthenticated or low-privilege access to the plugin's clone action endpoint

bash

# Update WC Fields Factory via WP-CLI
wp plugin update wc-fields-factory --version=4.1.11

# Verify installed version
wp plugin get wc-fields-factory --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate wc-fields-factory