Description

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-23T06:17:05.950Z",
  "pubdate": "2026-09-23T06:17:05.950Z",
  "executiveSummary": "The WC Fields Factory WordPress plugin, in versions prior to 4.1.11, contains a critical access control vulnerability within its field-management AJAX action. This security flaw allows authenticated users, regardless of their role (e.g., Subscribers), to perform unauthorized administrative operations. The vulnerability stems from improper authorization checks, which fail to validate whether the requester possesses the necessary permissions to modify post meta data. An attacker can exploit this weakness to alter arbitrary post meta, including WooCommerce product data. The risk implications are severe, as this grants malicious actors the ability to manipulate core product attributes, such as pricing, directly in the database. This unauthorized manipulation can be leveraged to execute fraudulent transactions by significantly reducing the checkout price of products. Exploitation requires only authenticated access to the WordPress instance, making it a high-risk vector for multi-user environments where user registration is enabled. The vulnerability undermines the integrity of the e-commerce store's backend data and financial operations.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization implementation within the plugin's field-management AJAX endpoint. In the affected versions (prior to 4.1.11), the plugin registers an AJAX action for handling field configurations that lacks a robust permission check (e.g., using current_user_can()). Because the plugin fails to verify if the executing user has administrative or shop-manager capabilities, the function processes requests from any authenticated user, including those with minimal privileges such as Subscribers.\nThe attack flow proceeds as follows: First, the attacker identifies the AJAX action responsible for updating field metadata. By crafting a POST request to the WordPress admin-ajax.php endpoint, the attacker includes parameters corresponding to the desired post ID and the meta keys/values they intend to modify. Because the application logic does not validate the object ownership or the user's role against the target resource, the server-side code proceeds to execute database operations using update_post_meta() or similar functions.\nThe impact of this exploitation is extensive due to the nature of WordPress post meta. Since WooCommerce stores critical data—such as price, stock levels, and product availability—as post meta, the ability to arbitrarily modify these fields allows an attacker to alter the financial outcomes of the store. Specifically, an attacker can manipulate stored pricing rules associated with a product, causing the WooCommerce checkout process to reference the tampered price rather than the authorized value. This results in direct financial loss and potential data corruption across the site's catalog.\nThis vulnerability is classified as an Improper Access Control issue. It permits unprivileged users to bypass standard WordPress capability checks, effectively granting them elevated control over the underlying post meta store. The vulnerability is exploitable over the network, as the AJAX handler is accessible to any user with a valid session cookie. By intercepting the request, an attacker can enumerate post IDs and systematically alter meta attributes for various products, leading to full unauthorized control over the e-commerce inventory and pricing structure."
}