What is the CVSS score of CVE-2026-4896?

CVE-2026-4896 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4896?

WCFM Frontend Manager for WooCommerce versions 6.7.25 and earlier contain an insecure direct object reference vulnerability that permits authenticated vendors to manipulate orders and delete…

Is there a public PoC exploit available for CVE-2026-4896?

Yes, a public proof-of-concept exploit is available for CVE-2026-4896. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4896?

Within 24 hours: Identify all WordPress instances running WCFM Frontend Manager ≤6.7.25 and document current vendor user accounts with active credentials; restrict vendor role permissions to read-only where possible pending patch availability. Within 7 days: Contact WCFM vendor for patch timeline and escalation; implement additional access controls or disable the plugin on non-critical environments if no patch is forthcoming. Within 30 days: Monitor vendor activity logs for suspicious order or content modifications; establish a patch deployment schedule immediately upon vendor release and test thoroughly before production rollout.

WordPress CVE-2026-4896

EUVD-2026-18981 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-04 Wordfence

GHSA-mjxj-p494-qx82

WordPress Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 04, 2026 - 07:45 euvd

EUVD-2026-18981

Analysis Generated

Apr 04, 2026 - 07:45 vuln.today

CVE Published

Apr 04, 2026 - 07:42 nvd

HIGH 8.1

DescriptionCVE.org

The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via multiple AJAX actions including wcfm_modify_order_status, delete_wcfm_article, delete_wcfm_product, and the article management controller due to missing validation on user-supplied object IDs. This makes it possible for authenticated attackers, with Vendor-level access and above, to modify the status of any order, delete or modify any post/product/page, regardless of ownership.

Articles & Coverage 1

vuln.today Threat Landscape 30/03-06/04/2026: Chrome Zero-Day, TrueConf Supply Chain, ShareFile Kill Chain Apr 06, 2026

AnalysisAI

Insecure Direct Object Reference in WCFM Frontend Manager for WooCommerce (versions ≤6.7.25) allows authenticated vendors to manipulate arbitrary orders and delete any WordPress posts, products, or pages beyond their ownership scope. Exploitation requires only vendor-level credentials (PR:L) with no user interaction, enabling privilege escalation through unauthorized access to store-wide content. EPSS data not available; no public exploit identified at time of analysis, though the vulnerability's straightforward IDOR nature increases weaponization risk once details are public.

Technical ContextAI

WCFM Frontend Manager (wclovers:wcfm_-_frontend_manager_for_woocommerce) is a WordPress plugin enabling multi-vendor marketplace functionality for WooCommerce stores. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where multiple AJAX endpoints-including wcfm_modify_order_status, delete_wcfm_article, delete_wcfm_product, and the article management controller-accept user-supplied object IDs without validating ownership or authorization boundaries. Per Wordfence source code analysis, these endpoints process resource identifiers directly from request parameters without cross-referencing the requesting user's permissions against the target object's ownership metadata. This violates the principle of complete mediation, allowing low-privileged vendor accounts to reference and manipulate global WordPress post IDs, WooCommerce order IDs, and product IDs that should be restricted to administrators or their actual owners.

RemediationAI

Upgrade WCFM Frontend Manager for WooCommerce to version 6.7.26 or later, which addresses the IDOR vulnerabilities through implementation of proper authorization checks on AJAX endpoints processing user-supplied object IDs. Site administrators should audit existing vendor accounts for suspicious activity, reviewing order status modification logs and checking for unexpected post/product deletions that may indicate prior exploitation. As an interim mitigation if immediate patching is infeasible, restrict vendor account creation to trusted users and implement additional monitoring on the identified AJAX actions (wcfm_modify_order_status, delete_wcfm_article, delete_wcfm_product) through WordPress security logging plugins. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f8248098-dff2-4bac-a138-aa40c7ab7a1c for additional context. For development teams, review the patched code paths in versions post-6.7.25 available via WordPress plugin repository to understand the corrected authorization logic pattern for user-controlled resource identifiers.