CVE-2026-93507

LowCVSS 3.3/10Last modified Sep 23, 2026

Description

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-935088.1The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authent CVE-2026-935096.5The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes th CVE-2026-93516.5A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function _is_blocked_device CVE-2026-935104.3The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call i CVE-2026-935115.3The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription no CVE-2026-935127.1Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.CVE-2026-935134.3Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.CVE-2026-935147.1Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.CVE-2026-93525.3A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools CVE-2026-935267.1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-935278.5Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.CVE-2026-935283.7The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, all