{"id":"CVE-2026-93507","aliases":["EUVD-2026-85060","GHSA-225c-7qjr-pm2w"],"status":"published","title":"WC Fields Factory \u003c 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00208,"percentile":0.10984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-23T06:00:23Z","modified":"2026-09-23T18:12:32Z","products":[{"vendor":"unknown","product":"wc fields factory"}],"references":[{"url":"https://wpscan.com/vulnerability/21569537-3a83-4df1-a6c2-8ca720e71586/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93507"},{"url":"https://wpscan.com/vulnerability/21569537-3a83-4df1-a6c2-8ca720e71586"},{"url":"https://github.com/advisories/GHSA-225c-7qjr-pm2w"}],"sources":{"cve":[{"id":"CVE-2026-93507","title":"WC Fields Factory \u003c 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.","status":"published","published":"2026-09-23T06:00:23.183Z","modified":"2026-09-23T10:51:29.814Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-85060","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.","status":"published","published":"2026-09-23T06:00:23Z","modified":"2026-09-23T10:51:29Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:01.283316Z"}],"ghsa":[{"id":"GHSA-225c-7qjr-pm2w","title":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or...","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.","status":"published","published":"2026-09-23T06:31:04Z","modified":"2026-09-23T12:31:12Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:12:19.869437Z"}],"nvd":[{"id":"CVE-2026-93507","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.","status":"published","published":"2026-09-23T06:17:05.843Z","modified":"2026-09-23T18:12:32.05Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:50.703874Z"}]}}