What is the CVSS score of CVE-2026-2554?

CVE-2026-2554 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WCFM Frontend Manager are affected by CVE-2026-2554?

WCFM - Frontend Manager for WooCommerce versions up to 6.7.25 contain a critical privilege escalation vulnerability allowing authenticated vendors to delete arbitrary WordPress users, including…

How to fix or mitigate CVE-2026-2554?

Within 24 hours: Inventory all WooCommerce installations using WCFM plugin and identify current versions. Within 7 days: Upgrade WCFM to version 6.7.26 or later on all affected systems; restrict vendor account permissions to minimum necessary levels pending patching. Within 30 days: Conduct access log review for any unauthorized user deletion attempts by vendor accounts; audit vendor account privileges and implement role-based access controls to limit administrative functions.

WCFM Frontend Manager CVE-2026-2554

EUVD-2026-26789 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-02 Wordfence

Authentication Bypass WordPress

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 14:01 vuln.today

EUVD ID Assigned

May 02, 2026 - 13:30 euvd

EUVD-2026-26789

Analysis Generated

May 02, 2026 - 13:30 vuln.today

CVE Published

May 02, 2026 - 13:26 nvd

HIGH 8.1

DescriptionCVE.org

The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators.

AnalysisAI

Authenticated vendors with low-level privileges can delete arbitrary WordPress users, including site administrators, via Insecure Direct Object Reference in WCFM - Frontend Manager for WooCommerce plugin versions up to 6.7.25. The vulnerability resides in the 'wcfm_delete_wcfm_customer' function which fails to validate user-controlled 'customerid' parameters, allowing privilege escalation through unauthorized user deletion. Patch available in version 6.7.26 per Trac changeset 3483695. No public exploit code or active exploitation confirmed at time of analysis, though CVSS 8.1 (High) reflects significant real-world impact if exploited by malicious vendors on WooCommerce marketplaces.

Technical ContextAI

WCFM - Frontend Manager for WooCommerce (cpe:2.3:a:wclovers:wcfm_-_frontend_manager_for_woocommerce) is a WordPress plugin enabling multi-vendor marketplace functionality for WooCommerce stores. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the class-wcfm-customer.php delete function accepts a 'customerid' parameter without verifying the requesting user has authority over that specific customer record. WordPress capability checks verify the requester has 'vendor' role but do not enforce object-level authorization, allowing horizontal privilege escalation to manipulate any user ID. This IDOR pattern is particularly severe in multi-vendor platforms where vendors should only access their own customer data, not platform administrators or other vendors' accounts.

RemediationAI

Upgrade to WCFM - Frontend Manager for WooCommerce version 6.7.26 or later, which implements proper authorization checks per WordPress Trac changeset 3483695 (https://plugins.trac.wordpress.org/changeset/3483695/). If immediate patching is infeasible, implement compensating controls: (1) Audit and restrict vendor role assignment to only thoroughly vetted merchants, eliminating untrusted vendor accounts. Trade-off: impacts marketplace growth but prevents malicious vendor enrollment. (2) Enable WordPress activity logging (plugins like WP Activity Log) to detect suspicious user deletion events, particularly admin account removals by vendor-role users. Trade-off: detective not preventive control, requires active monitoring. (3) Database-level triggers or backup retention policies to enable rapid admin account restoration. Trade-off: mitigates availability impact but does not prevent initial compromise. No workaround fully eliminates risk without vendor-supplied patch addressing root CWE-639 authorization bypass.