WCFM Frontend Manager CVE-2026-2554

Requires authenticated access with WordPress Vendor role or higher capability within the WCFM plugin permission system. The attacker must have a legitimate vendor account on the target WooCommerce marketplace-either through social engineering to pass vendor vetting processes, or by compromising existing vendor credentials. Default WCFM installations with open vendor registration are at highest risk. Vulnerability is exploitable against any WordPress site running WCFM versions ≤6.7.25 where the vendor role has access to customer management functions. No specific WooCommerce configuration, PHP version, or server-side settings limit exploitation beyond the fundamental requirement of vendor-level authentication.

Real-world risk is HIGH for WooCommerce marketplace operators but requires insider threat scenario. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity once vendor credentials are obtained, with high integrity and availability impact (deleting admin accounts effectively compromises site control). However, PR:L (low privileges required) means attackers must first obtain legitimate vendor account credentials, limiting opportunistic exploitation. No EPSS score, KEV listing, or public POC identified, suggesting purely theoretical exploitation status. SSVC framework assessment: exploitation not confirmed, requires authenticated access (not automatable against arbitrary targets), technical impact is total (admin deletion = full site compromise). Priority depends on vendor vetting practices: high-trust vendor programs face lower risk than open vendor registration. Missing vendor advisory makes patch adoption tracking difficult.

A malicious actor registers as a legitimate vendor on a WooCommerce marketplace running WCFM plugin version 6.7.24. After account approval, the attacker crafts authenticated requests to the 'wcfm_delete_wcfm_customer' AJAX endpoint, iterating through user IDs to identify and delete administrator accounts (typically user ID 1-10 in WordPress). With administrators removed, the attacker either promotes their vendor account to admin via database manipulation or exploits the power vacuum to take control through remaining lower-privileged accounts. The low attack complexity (AC:L) means exploitation requires only basic understanding of WordPress user ID enumeration and AJAX endpoint interaction.