A high-severity authentication flaw in the WC Fields Factory plugin allows authenticated users to manipulate product metadata and pricing, posing a significant risk to e-commerce integrity.

This vulnerability is categorized as CWE-862, Missing Authorization. It occurs because the plugin fails to properly restrict access to its field-management AJAX action, allowing any authenticated user with Subscriber-level access or higher to perform unauthorized modifications to post meta and product pricing.

Successful exploitation of this vulnerability allows an attacker to alter product pricing or metadata, which could lead to direct financial loss through fraudulent checkout transactions. Given the CVSS score of 8.1, the vulnerability represents a high risk to business operations, potentially impacting revenue and data integrity across affected WooCommerce environments.

Immediate Action: Update the WC Fields Factory plugin to version 4.1.11 or later to implement the necessary authorization checks.

Proactive Monitoring: Review web access logs for anomalous requests directed at the plugin's AJAX endpoints and monitor WooCommerce order history for unexpected pricing discrepancies.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable field-management AJAX action until the update can be applied.

Public Exploit Available: Unknown

Organizations utilizing the WC Fields Factory plugin must prioritize this update, as the ability for low-privileged users to modify product pricing presents an unacceptable business risk. Apply version 4.1.11 immediately to close the authorization gap and ensure that only authorized administrators can manage plugin fields and associated product meta.