CVE-2026-93508 Overview
The WC Fields Factory WordPress plugin before version 4.1.11 contains a broken access control flaw in its field-management AJAX action. The plugin fails to enforce authorization checks, allowing any authenticated user with Subscriber-level access or higher to create, modify, and delete arbitrary post metadata on any post. Attackers can target WooCommerce products regardless of ownership and manipulate stored pricing rules to reduce checkout prices. The issue is tracked under CWE-862: Missing Authorization.
Critical Impact
Any registered Subscriber account can tamper with WooCommerce product metadata and lower checkout prices, enabling fraudulent purchases and store-wide data integrity loss.
Affected Products
- WC Fields Factory WordPress plugin versions prior to 4.1.11
- WooCommerce stores using WC Fields Factory for product field management
- WordPress sites permitting Subscriber-level account registration with the vulnerable plugin installed
Discovery Timeline
- 2026-09-23 - CVE-2026-93508 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-93508
Vulnerability Analysis
The vulnerability stems from a missing authorization check on an AJAX handler exposed by the WC Fields Factory plugin. WordPress AJAX endpoints registered under wp_ajax_ hooks are available to any authenticated user unless the handler explicitly validates capabilities. In this case, the field-management action does not verify that the caller owns the target post or holds an appropriate capability such as edit_post or manage_woocommerce.
Because the handler operates on arbitrary post identifiers supplied by the request, attackers can direct it at any post ID in the database. This includes published WooCommerce product records and their associated pricing metadata.
Root Cause
The root cause is a Missing Authorization defect [CWE-862]. The affected AJAX action executes post meta write operations without a corresponding current_user_can() capability check tied to the target object. The Subscriber role is the lowest authenticated tier in WordPress, and by default it holds no editing capabilities on posts or products.
Attack Vector
Exploitation requires a valid authenticated session at Subscriber level or higher. On stores that allow customer account registration, this precondition is trivially met by signing up as a normal shopper. The attacker submits a crafted POST request to the plugin's AJAX endpoint with a target post ID and payload representing the desired meta keys and values.
By overwriting the meta entries that store WC Fields Factory pricing rules on a product, the attacker can force the checkout total to a value of their choosing. The same primitive supports deleting or corrupting meta on unrelated posts, causing broader integrity damage across the site. Full technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-93508
Indicators of Compromise
- WooCommerce orders completed at prices materially below configured product pricing, particularly from newly registered Subscriber accounts.
- Unexpected wp_postmeta rows or modifications on product posts that reference WC Fields Factory pricing keys.
- Access log entries showing POST requests from Subscriber sessions to admin-ajax.php invoking the plugin's field-management action.
Detection Strategies
- Correlate authenticated admin-ajax.php traffic with the acting user's role and flag write actions issued by Subscriber accounts.
- Baseline product meta values and alert when pricing-related meta keys change outside of administrator workflows.
- Review WooCommerce order records for discounts that were not produced by a coupon, promotion, or admin action.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and retain request bodies to support post-incident analysis of AJAX action names and parameters.
- Monitor creation of new low-privilege user accounts followed shortly by AJAX write activity against product posts.
- Alert on direct database changes to wp_postmeta rows tied to product IDs when the change is not attributable to an editor or administrator session.
How to Mitigate CVE-2026-93508
Immediate Actions Required
- Upgrade WC Fields Factory to version 4.1.11 or later on every WordPress site where the plugin is installed.
- Audit WooCommerce orders placed since the plugin was installed for prices inconsistent with the intended product configuration.
- Review recent changes to product post meta and restore trusted values where tampering is suspected.
Patch Information
The vendor addressed the issue in WC Fields Factory version 4.1.11 by adding the missing authorization checks to the field-management AJAX action. Administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the WC Fields Factory plugin until the patched version can be deployed.
- Restrict new customer account registration, or require manual approval, to remove the Subscriber precondition needed for exploitation.
- Deploy a web application firewall rule that blocks unauthenticated-role users from invoking the plugin's AJAX action name.
# Configuration example: block Subscriber-level access to the vulnerable AJAX action at the web tier
# Example ModSecurity rule (adjust action name to match plugin internals)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1026093508,\
msg:'Block WC Fields Factory field-management AJAX abuse (CVE-2026-93508)'"
SecRule ARGS:action "@rx ^wcff_" "t:lowercase"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.