What is the CVSS score of CVE-2026-0845?

CVE-2026-0845 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-0845?

Organizations running the WCFM Frontend Manager plugin for WooCommerce are vulnerable to unauthorized privilege escalation attacks that could allow attackers to gain administrative access to…

How to fix or mitigate CVE-2026-0845?

Within 24 hours: Identify all WordPress instances running WCFM plugin versions up to 6.7.24 and document exposure. Within 7 days: Implement compensating controls including WAF rules to block malicious requests to the vulnerable WCFM_Settings_Controller::processing function, restrict plugin access to authenticated admin users only, and disable the plugin if not actively required for operations. Within 30 days: Monitor vendor for patch release, conduct security audit of affected systems for unauthorized modifications, and prepare for immediate patching upon availability.

WordPress CVE-2026-0845

HIGH

Missing Authorization (CWE-862)

2026-02-10 security@wordfence.com

WordPress Privilege Escalation

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 00:16 nvd

HIGH 7.2

DescriptionCVE.org

The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

AnalysisAI

Unauthorized option modification in WCFM - Frontend Manager for WooCommerce up to version 6.7.24 allows authenticated Shop Manager-level users to bypass capability checks and alter arbitrary WordPress settings. An attacker with these privileges can exploit this to change the default registration role to administrator and enable user registration, gaining full admin access to the site. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be l

Affected ProductsAI

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized mo