The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
CVE-2026-93507
NONE
Updated Sep 23, 2026
WordPress
CVE Details
CVE ID
CVE-2026-93507
Published Date
Sep 23, 2026
Vendor
WordPress
Severity
NONE
Impact
Minimal impact
Source
View Advisory