EUVD-2026-85061
GHSA-fmf3-2pcf-wpmg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network AJAX action, low complexity, needs only a Subscriber account (PR:L); primary impact is arbitrary meta/price tampering (I:H) with limited data exposure (C:L) and no availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
7DescriptionCVE.org
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
AnalysisAI
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target site to run WC Fields Factory before 4.1.11 alongside WooCommerce, and the attacker must hold at least a Subscriber-level authenticated account (PR:L) - trivially met where WooCommerce customer self-registration is enabled (a common/default configuration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable priority for any store running the plugin, though not a mass-internet-scanning emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 4.1.11 - upgrade the WC Fields Factory WordPress plugin to 4.1.11 or later, per the WPScan advisory at https://wpscan.com/vulnerability/a927f6d6-90d8-4b91-aed4-f5f53d2b5c64/; this is the primary and complete fix and should be applied to every site running the plugin, not just WooCommerce stores. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress/WooCommerce sites for WC Fields Factory versions before 4.1.11 and update to 4.1.11 or later; where an immediate update is not feasible, deactivate the plugin or temporarily disable Subscriber-level access to field-management functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today