CVE-2026-93508: CWE-862 Missing Authorization in WC Fields Factory
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
AI Analysis
Technical Summary
CVE-2026-93508 is a missing authorization vulnerability (CWE-862) in the WC Fields Factory WordPress plugin versions prior to 4.1.11. The plugin does not properly restrict access to its field-management AJAX action, enabling authenticated users with minimal privileges (Subscriber-level and above) to perform unauthorized modifications to post meta data on any post, including WooCommerce products. This includes the ability to alter pricing rules, potentially affecting product prices at checkout.
Potential Impact
Authenticated users with Subscriber-level access or higher can exploit this vulnerability to modify arbitrary post meta data on any post, including WooCommerce products they do not own. This can lead to unauthorized changes such as manipulating product pricing rules to reduce checkout prices, potentially causing financial loss to the site owner.
Mitigation Recommendations
A fixed version of the WC Fields Factory plugin is available at version 4.1.11. Users should upgrade to version 4.1.11 or later to remediate this vulnerability. Until then, restrict plugin access to trusted users only and monitor user roles carefully.
CVE-2026-93508: CWE-862 Missing Authorization in WC Fields Factory
Description
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Affected software
WC Fields Factory
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93508 is a missing authorization vulnerability (CWE-862) in the WC Fields Factory WordPress plugin versions prior to 4.1.11. The plugin does not properly restrict access to its field-management AJAX action, enabling authenticated users with minimal privileges (Subscriber-level and above) to perform unauthorized modifications to post meta data on any post, including WooCommerce products. This includes the ability to alter pricing rules, potentially affecting product prices at checkout.
Potential Impact
Authenticated users with Subscriber-level access or higher can exploit this vulnerability to modify arbitrary post meta data on any post, including WooCommerce products they do not own. This can lead to unauthorized changes such as manipulating product pricing rules to reduce checkout prices, potentially causing financial loss to the site owner.
Mitigation Recommendations
A fixed version of the WC Fields Factory plugin is available at version 4.1.11. Users should upgrade to version 4.1.11 or later to remediate this vulnerability. Until then, restrict plugin access to trusted users only and monitor user roles carefully.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-18T08:38:53.433Z
- State
- PUBLISHED
Threat ID: 6ab36d45f7a7c541065abcd2
Added to database: 09/23/2026, 06:10:13 UTC
Last enriched: 09/23/2026, 06:17:51 UTC
Last updated: 09/23/2026, 08:55:55 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.