CVE-2026-93508
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Risk Assessment
A low-privileged attacker can modify product data and lower prices in a WooCommerce store, leading to financial losses and data integrity violations.
Recommendation
Update the WC Fields Factory plugin to version 4.1.11 or later and verify that product pricing rules have not been modified.
Other vulnerabilities in WC Fields Factory
Original NVD description (English source)
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS