CVE-2026-93507 | BDVDB-2026-378338 Detail

Description#

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-23Record published in the CVE List.