Wc Fields Factory
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wc_fields_factory:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wc Fields Factory (56aa3623-9e25-55bf-a7ec-bb5a4291dbc9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-93507 |
vulnerable | 2026-10-13 12:28:56.167973 |
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Published: 2026-09-23T06:00:23.183Z
Updated: 2026-09-23T10:51:29.814Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93508 |
vulnerable | 2026-10-13 12:28:55.970517 |
WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Published: 2026-09-23T06:00:23.379Z
Updated: 2026-09-23T10:51:14.948Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0277 |
vulnerable | 2026-06-08 05:52:04.663406 |
WC Fields Factory <= 4.1.5 - ShopManager+ SQLi
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Published: 2023-04-17T12:17:40.775Z
Updated: 2025-02-06T15:30:15.424Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.