{"id":"CVE-2026-93507","published":"2026-09-23T06:17:05.843","lastModified":"2026-09-23T18:12:32.050","description":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.","cvssScore":3.3,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/21569537-3a83-4df1-a6c2-8ca720e71586/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}