WordPress Plugin Allows Subscribers to Manipulate Product Pricing

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WC Fields Factory WordPress plugin before version 4.1.11 contains an authorization bypass vulnerability in its AJAX field-management functionality. Authenticated users with minimal Subscriber-level permissions can exploit insufficient access controls to create, modify, and delete arbitrary post metadata across any post type—including WooCommerce products they don't own. This enables attackers to directly manipulate product pricing rules at checkout, potentially causing significant financial losses through unauthorized price reductions. Any WordPress site running the vulnerable plugin with WooCommerce integration is at risk, particularly those with open user registration or multiple contributor accounts.

Casky's 283 matching skills map detection patterns across MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would identify this attack through behavioral anomalies: unauthorized AJAX requests to field-management endpoints from low-privilege accounts, unusual post-meta modification patterns on high-value products, and suspicious pricing rule alterations without corresponding admin actions. Claude's extended reasoning across the security skill set enables detection of the attack chain—from initial low-privilege authentication through lateral metadata manipulation to financial impact—revealing how a Subscriber account pivots into e-commerce system compromise. Security teams would surface these findings as unauthorized privilege escalation patterns and data modification anomalies requiring immediate remediation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-93508.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-93508

Casky has 283 skills that investigate the attack patterns behind CVE-2026-93508. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn