What is the CVSS score of CVE-2026-10041?

CVE-2026-10041 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

WCFM Frontend Manager CVE-2026-10041

EUVD-2026-43162 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-11 Wordfence

GHSA-mpgm-9gr3-fhr6

WordPress Authentication Bypass Wcfm Frontend Manager For Woocommerce Wordpress Plugin Wclovers

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

A:L added over the official scoring because permanent deletion of enquiries and bulk messages constitutes limited availability impact beyond the integrity dimension; all other metrics match the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 07:09 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 4.3

DescriptionCVE.org

The WCFM - Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.

AnalysisAI

Unauthorized cross-vendor manipulation in WCFM - Frontend Manager for WooCommerce (all versions ≤ 6.7.27) allows authenticated subscriber-level users to archive competitor vendors' product listings, toggle featured status on arbitrary listings, mark WooCommerce orders as completed, and permanently delete enquiries and bulk messages belonging to other vendors within the same marketplace. Multiple AJAX handlers in class-wcfm-ajax.php, class-wcfm-enquiry.php, and class-wcfm-notification.php accept user-controlled object IDs without verifying ownership - a textbook CWE-639 IDOR pattern enabling horizontal privilege escalation across vendor accounts. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

WCFM - Frontend Manager for WooCommerce (CPE: cpe:2.3:a:wclovers:wcfm_-_frontend_manager_for_woocommerce:*:*:*:*:*:*:*:*) is a WordPress plugin that extends WooCommerce into a multi-vendor marketplace, granting individual vendors a frontend dashboard to manage their own product listings, orders, and communications. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's AJAX handlers receive user-supplied IDs for products, orders, enquiries, and messages as direct database references without performing ownership checks. Specifically, the wcfm_product_archive action in class-wcfm-ajax.php at lines 746, 779, and 810 (confirmed in both tags/6.7.26 and tags/6.7.27 on the WordPress plugin SVN) and related handlers in class-wcfm-enquiry.php:L395 and class-wcfm-notification.php:L1132 all process these IDs with missing or insufficient authorization validation, allowing any low-privilege authenticated user to reference and manipulate objects owned by any other vendor on the platform.

RemediationAI

A fix was committed to the WordPress plugin repository per the SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3588570%40wc-frontend-manager&new=3588570%40wc-frontend-manager; however, the specific patched release version number is not explicitly stated in the available data - the upstream fix is confirmed by commit but has not been independently verified as a tagged release. Administrators should update to the latest available version of the plugin from the WordPress repository and confirm the installed version exceeds 6.7.27. As a compensating control while patching, restrict or disable open subscriber-level account registration on the affected marketplace to reduce the pool of potential unauthorized users; note this may impact legitimate vendor onboarding workflows. Implementing a web application firewall rule to flag anomalous AJAX POST requests to wp-admin/admin-ajax.php targeting wcfm_product_archive with product IDs inconsistent with the authenticated user's vendor account can serve as a detection layer. Store operators should audit recent product archive events, order status changes, and deleted enquiries for signs of prior unauthorized manipulation.