What is the CVSS score of CVE-2026-12994?

CVE-2026-12994 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

WCFM Frontend Manager CVE-2026-12994

EUVD-2026-43156 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-x34r-gp68-rfqr

WordPress Authentication Bypass Wcfm Frontend Manager For Woocommerce Wordpress Plugin Wclovers

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

AV:N and PR:N confirmed by code: nonce is publicly exposed on every page with no login gate, so no privileges or network proximity required; only integrity impact applies as records are overwritten but no data is read or availability disrupted.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:58 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WCFM - Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in wp_wcfm_enquiries, and trigger unsolicited notification emails to customers and vendors. Unlike sibling controller branches (wcfm-enquiry and wcfm-enquiry-manage), the wcfm-my-account-enquiry-manage branch performs no is_user_logged_in() or current_user_can() check, and the nonce that serves as the sole barrier is embedded into every public page load without any login gate.

AnalysisAI

Authorization bypass in WCFM - Frontend Manager for WooCommerce (all versions through 6.7.27) allows unauthenticated network attackers to inject arbitrary content into store inquiry replies, overwrite inquiry records in the wp_wcfm_enquiries database table, and trigger unsolicited notification emails to customers and vendors. The root cause is a missing authentication gate in the wcfm-my-account-enquiry-manage controller branch - unlike its sibling branches, it performs neither is_user_logged_in() nor current_user_can() checks. The nonce that serves as the sole barrier is embedded into every public page load without any login requirement, rendering it ineffective as an access control. No public exploit code and no CISA KEV listing identified at time of analysis.

Technical ContextAI

The affected product (CPE: cpe:2.3:a:wclovers:wcfm_-_frontend_manager_for_woocommerce:*:*:*:*:*:*:*:*) is a WooCommerce extension that provides frontend multivendor store management capabilities, including a store inquiry/messaging system between customers and vendors. The vulnerability is classified as CWE-862 (Missing Authorization). The AJAX action wcfm-my-account-enquiry-manage routes to wcfm-controller-enquiry-manage.php; at lines L278 and L290 in both the 6.7.26 and 6.7.27 tagged releases, no user authentication or capability verification is performed, in contrast to the wcfm-enquiry and wcfm-enquiry-manage sibling branches which correctly gate access. Additionally, class-wcfm-frontend.php at L1197 unconditionally outputs the nonce to every public page, making nonce-based CSRF protection meaningless as an authorization barrier - any site visitor can retrieve a valid nonce without logging in. The inquiry data is stored in and overwritten against the wp_wcfm_enquiries WordPress database table.

RemediationAI

Update the WCFM - Frontend Manager for WooCommerce plugin to a version newer than 6.7.27 once a patched release is confirmed available. A patch commit is referenced in the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3588570%40wc-frontend-manager&new=3588570%40wc-frontend-manager, indicating upstream code has been fixed, but the exact released plugin version incorporating this fix has not been independently confirmed from the available data - monitor the Wordfence advisory and the WordPress plugin page for a confirmed patched version number before upgrading. As a compensating control, administrators who do not rely on the store inquiry feature can disable it entirely within WCFM settings, eliminating the vulnerable code path with no other side effects. For stores that require inquiry functionality, deploying a WAF rule to block AJAX POST requests targeting the action=wcfm-my-account-enquiry-manage parameter for unauthenticated sessions is a viable interim control, though it requires WAF capability and carries a small risk of blocking edge cases if nonce handling changes. Avoid relying on nonce-only protection as an authorization mechanism in WordPress plugins, as this CVE demonstrates that nonces embedded in public pages provide no authentication guarantee.