EUVD-2026-43156
GHSA-x34r-gp68-rfqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad public store page to harvest nonce
-
DeliveryEnumerate wp_wcfm_enquiries inquiry IDs
-
ExploitCraft POST to wp-admin/admin-ajax.php with wcfm-my-account-enquiry-manage action
-
ExecutionBypass missing authorization check in controller
-
PersistOverwrite inquiry record with arbitrary content
-
ImpactTrigger spam notification emails to customer and vendor
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the WCFM store inquiry feature is active - a core, default-enabled feature of WCFM multivendor stores. The vulnerable action wcfm-my-account-enquiry-manage is reachable via wp-admin/admin-ajax.php from any network-connected client; no session cookie, authentication token, or elevated privilege is required. The nonce passed with the request must be valid, but this is trivially satisfied because class-wcfm-frontend.php L1197 embeds the nonce into every public page without any login gate - bots and anonymous visitors alike can retrieve it. The attacker must supply a valid inquiry ID to target a specific record; WordPress auto-increment integer IDs are sequential by default, making enumeration feasible at low cost given the zero-authentication overhead. Limiting factors: the impact is confined to the inquiry/messaging subsystem and does not expose confidential data or disrupt service; stores with no active inquiries or with the inquiry feature disabled are not affected. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a 5.3 Medium score, which is well-supported by the code-level evidence: network exploitation is trivial, the nonce is publicly available without authentication, and no complexity barriers exist. The impact is correctly limited to Integrity (I:L) - attackers can corrupt inquiry records and abuse the email notification system, but cannot read sensitive data (C:N) or disrupt service availability (A:N). No EPSS data was provided in the intelligence, so exploitation probability cannot be quantitatively assessed. The vulnerability has no CISA KEV listing and no known POC at time of analysis, suggesting it has not been actively weaponized at scale. Real-world risk is elevated for WooCommerce multivendor stores that rely on the inquiry system for customer communication - attackers could poison inquiry threads, impersonate vendor replies, and generate spam email floods through the store's own mail infrastructure. The requirement to know or enumerate a valid inquiry ID in wp_wcfm_enquiries provides a marginal friction point, though WordPress auto-increment IDs are typically sequential and easily bruted at low cost given zero auth overhead. |
| Exploit ScenarioDerived | An unauthenticated attacker loads any public-facing page of the WooCommerce store, extracts the wcfm nonce value from the page HTML, and sends a crafted HTTP POST to wp-admin/admin-ajax.php with action=wcfm-my-account-enquiry-manage, a guessed or enumerated inquiry ID, and attacker-controlled reply content. Because no is_user_logged_in() or current_user_can() check is performed, the server writes the injected content into the wp_wcfm_enquiries record and dispatches the store's notification email to both the affected customer and vendor. No POC code has been publicly disclosed at time of analysis, though the attack is mechanically straightforward given the publicly documented code paths. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Authorization bypass in WCFM - Frontend Manager for WooCommerce (all versions through 6.7.27) allows unauthenticated network attackers to inject arbitrary content into store inquiry replies, overwrite inquiry records in the wp_wcfm_enquiries database table, and trigger unsolicited notification emails to customers and vendors. The root cause is a missing authentication gate in the wcfm-my-account-enquiry-manage controller branch - unlike its sibling branches, it performs neither is_user_logged_in() nor current_user_can() checks. The nonce that serves as the sole barrier is embedded into every public page load without any login requirement, rendering it ineffective as an access control. No public exploit code and no CISA KEV listing identified at time of analysis.
RemediationAI
Update the WCFM - Frontend Manager for WooCommerce plugin to a version newer than 6.7.27 once a patched release is confirmed available. A patch commit is referenced in the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3588570%40wc-frontend-manager&new=3588570%40wc-frontend-manager, indicating upstream code has been fixed, but the exact released plugin version incorporating this fix has not been independently confirmed from the available data - monitor the Wordfence advisory and the WordPress plugin page for a confirmed patched version number before upgrading. As a compensating control, administrators who do not rely on the store inquiry feature can disable it entirely within WCFM settings, eliminating the vulnerable code path with no other side effects. For stores that require inquiry functionality, deploying a WAF rule to block AJAX POST requests targeting the action=wcfm-my-account-enquiry-manage parameter for unauthenticated sessions is a viable interim control, though it requires WAF capability and carries a small risk of blocking edge cases if nonce handling changes. Avoid relying on nonce-only protection as an authorization mechanism in WordPress plugins, as this CVE demonstrates that nonces embedded in public pages provide no authentication guarantee.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product (CPE: cpe:2.3:a:wclovers:wcfm_-_frontend_manager_for_woocommerce:*:*:*:*:*:*:*:*) is a WooCommerce extension that provides frontend multivendor store management capabilities, including a store inquiry/messaging system between customers and vendors. The vulnerability is classified as CWE-862 (Missing Authorization). The AJAX action wcfm-my-account-enquiry-manage routes to wcfm-controller-enquiry-manage.php; at lines L278 and L290 in both the 6.7.26 and 6.7.27 tagged releases, no user authentication or capability verification is performed, in contrast to the wcfm-enquiry and wcfm-enquiry-manage sibling branches which correctly gate access. Additionally, class-wcfm-frontend.php at L1197 unconditionally outputs the nonce to every public page, making nonce-based CSRF protection meaningless as an authorization barrier - any site visitor can retrieve a valid nonce without logging in. The inquiry data is stored in and overwritten against the wp_wcfm_enquiries WordPress database table.
Know when Wcfm Frontend Manager For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N and PR:N confirmed by code: nonce is publicly exposed on every page with no login gate, so no privileges or network proximity required; only integrity impact applies as records are overwritten but no data is read or availability disrupted.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WCFM - Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in wp_wcfm_enquiries, and trigger unsolicited notification emails to customers and vendors. Unlike sibling controller branches (wcfm-enquiry and wcfm-enquiry-manage), the wcfm-my-account-enquiry-manage branch performs no is_user_logged_in() or current_user_can() check, and the nonce that serves as the sole barrier is embedded into every public page load without any login gate.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Insecure Direct Object Reference in WCFM Frontend Manager for WooCommerce (versions ≤6.7.25) allows authenticated vendor
Authenticated vendors with low-level privileges can delete arbitrary WordPress users, including site administrators, via
Unauthorized cross-vendor manipulation in WCFM - Frontend Manager for WooCommerce (all versions ≤ 6.7.27) allows authent
Exploit-DB