Executive brief
The WC Fields Factory WordPress plugin allows low-privileged users (Subscribers) to arbitrarily modify product data and prices through an unsecured AJAX handler. An attacker could manipulate product pricing, change product attributes, and alter WooCommerce settings across the site, leading to fraudulent transactions and data corruption.
Technical details
The plugin fails to properly enforce authorization checks on a field-management AJAX action, allowing authenticated users with Subscriber-level permissions to craft requests that create, modify, and delete arbitrary post meta on any post. This broken access control (CWE-862) permits attackers to manipulate WooCommerce product pricing rules and metadata without ownership restrictions. The vulnerability requires authentication but no additional user interaction.
Affected products
- WC Fields Factory Contributors WC Fields Factory before 4.1.11
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in version 4.1.11