WooCommerce Frontend Manager Ultimate CVE-2026-22335

Attacker must hold a valid WordPress Subscriber-level (or higher) account on a site running WooCommerce Frontend Manager - Ultimate at version 6.7.6 or earlier; on default WooCommerce installations this is satisfied by self-registration through the My Account page or checkout flow. Exploitation is limited to sites that have the WC Frontend Manager - Ultimate premium add-on installed and active (the free WC Frontend Manager base plugin is a separate code path), and requires network reach to the WordPress admin-ajax or REST endpoint exposed by the plugin. No user interaction from an administrator is needed, but if the site has disabled new-user registration, the attacker must first obtain Subscriber credentials by other means.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) indicates a network-reachable, low-complexity attack that only requires a Subscriber account - trivial to obtain on any WooCommerce store that allows customer registration, which is the default. The scope change and High confidentiality impact place this above a typical authenticated SQLi because the attacker can read data outside the plugin's own tables (e.g., password hashes, secret keys, order PII). No EPSS, KEV, or SSVC data was provided, and no public PoC is referenced; Patchstack's advisory is the sole source. This should still be treated as a real priority for any site running the plugin because the precondition (a Subscriber account on a WooCommerce shop) is effectively free for an attacker.

An attacker self-registers a free Subscriber account on a target WooCommerce shop running WC Frontend Manager - Ultimate <= 6.7.6, authenticates, and sends a crafted request to a plugin-handled endpoint with a SQL payload in a parameter that is interpolated into a database query. Because the scope is Changed and impact reaches the shared WordPress database, the attacker exfiltrates wp_users password hashes, secret_key values from wp_options, and customer PII from WooCommerce order tables. No public exploit identified at time of analysis, but the Subscriber-only precondition makes opportunistic mass-scanning trivial once details are reverse-engineered from the 6.7.7 patch.