WordPress WC Fields Factory plugin < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation vulnerability

Subscriber+ Arbitrary Post Meta Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...

CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-93508

The WC Fields Factory WordPress plugin, in versions prior to 4.1.11 , is vulnerable to unauthorized access because it fails to properly restrict its field-management AJAX action . This flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized actions, includin...

CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...