WCFM Frontend Manager CVE-2026-10041

Exploitation requires an authenticated WordPress account at subscriber level or above - the minimum role assignable to a registered user on most WordPress sites. The target site must have the WCFM - Frontend Manager for WooCommerce plugin active at version 6.7.27 or earlier and must operate as a multi-vendor marketplace with at least one other active vendor whose content can be targeted. Vulnerable AJAX endpoints include: wcfm_product_archive in class-wcfm-ajax.php (lines 746, 779, 810 in both 6.7.26 and 6.7.27), the enquiry deletion handler in class-wcfm-enquiry.php (line 395), and the notification/message handler in class-wcfm-notification.php (line 1132). Limiting factors: anonymous (unauthenticated) exploitation is not possible per the CVSS PR:L vector; no confidentiality data is exposed, ruling out data theft scenarios; impact is bounded to cross-vendor content manipulation within the same WordPress instance, not cross-site or infrastructure compromise; single-vendor WooCommerce deployments without active multi-vendor use are not meaningfully exposed.

The NVD CVSS 3.1 base score of 4.3 (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - network-accessible, low complexity, low-privilege authenticated, with only limited integrity impact. However, this scoring understates the practical business impact in multi-vendor marketplace deployments: the ability to permanently delete competitor enquiries and bulk messages, archive product listings, and mark orders as completed without fulfillment constitutes meaningful operational disruption beyond what I:L typically implies. No EPSS score was included in the available intelligence, so probability-based prioritization cannot be applied. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, placing this in the category of known-but-not-actively-exploited. Risk is highest where WordPress stores permit open subscriber registration alongside active WCFM multi-vendor use; single-vendor WooCommerce deployments gain negligible attack surface from this flaw. The low complexity and subscriber-level authentication bar mean exploitation is straightforward once an account is obtained, but the absence of confidentiality impact limits escalation paths.

An attacker registers a free subscriber account on a WooCommerce marketplace running the vulnerable WCFM plugin, then issues crafted AJAX POST requests to wp-admin/admin-ajax.php supplying competitor vendors' product IDs in the wcfm_product_archive action parameter - actions the server processes without ownership validation. By iterating over enumerable product or order IDs, the attacker archives a rival vendor's entire product catalog, marks their pending orders as fulfilled, and permanently deletes inbound customer enquiries, causing direct revenue and reputational harm. No public proof-of-concept has been identified, but the vulnerable code paths are publicly accessible via the WordPress SVN source references, making independent reproduction straightforward.