{"id":"CVE-2026-93508","aliases":["EUVD-2026-85061","GHSA-fmf3-2pcf-wpmg"],"status":"published","title":"WC Fields Factory \u003c 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00207,"percentile":0.10825,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-23T06:00:23Z","modified":"2026-09-23T18:12:32Z","products":[{"vendor":"unknown","product":"wc fields factory"}],"references":[{"url":"https://wpscan.com/vulnerability/a927f6d6-90d8-4b91-aed4-f5f53d2b5c64/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93508"},{"url":"https://wpscan.com/vulnerability/a927f6d6-90d8-4b91-aed4-f5f53d2b5c64"},{"url":"https://github.com/advisories/GHSA-fmf3-2pcf-wpmg"}],"sources":{"cve":[{"id":"CVE-2026-93508","title":"WC Fields Factory \u003c 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.","status":"published","published":"2026-09-23T06:00:23.379Z","modified":"2026-09-23T10:51:14.948Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:54.50686Z"}],"euvd":[{"id":"EUVD-2026-85061","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.","status":"published","published":"2026-09-23T06:00:23Z","modified":"2026-09-23T10:51:14Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:01.283316Z"}],"ghsa":[{"id":"GHSA-fmf3-2pcf-wpmg","title":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its...","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.","status":"published","published":"2026-09-23T06:31:04Z","modified":"2026-09-23T12:31:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:12:19.869437Z"}],"nvd":[{"id":"CVE-2026-93508","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.","status":"published","published":"2026-09-23T06:17:05.95Z","modified":"2026-09-23T18:12:32.05Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:50.703874Z"}]}}