Wcfm Frontend Manager For Woocommerce EUVD-2026-18981

Requires authenticated WordPress user with Vendor-level access or higher to WCFM plugin. Attacker exploits AJAX actions (wcfm_modify_order_status, delete_wcfm_article, delete_wcfm_product) in plugin versions up to 6.7.25 by supplying arbitrary object IDs to modify/delete orders and posts across all vendors.

The CVSS 8.1 HIGH rating reflects network-based exploitation (AV:N) with low complexity (AC:L) and no user interaction (UI:N), requiring only low-privileged vendor credentials (PR:L). High integrity and availability impact (I:H/A:H) accurately captures the ability to alter order statuses marketplace-wide and delete critical content, potentially causing business disruption and data loss. However, real-world risk depends heavily on deployment context: WooCommerce stores using WCFM with multiple vendor accounts face elevated exposure, as any compromised or malicious vendor can sabotage competitors' products, manipulate financial transactions, or delete store pages. The authentication requirement (PR:L) reduces surface area compared to unauthenticated flaws, but vendor registration is often self-service in marketplace implementations. No public exploit identified at time of analysis, though IDOR vulnerabilities are trivially exploitable once endpoint details are known-expect rapid weaponization post-disclosure. Without EPSS data or KEV listing, prioritization should focus on stores with untrusted vendor populations or those processing high transaction volumes where order manipulation poses financial/reputational harm.

A malicious actor registers a vendor account on a WooCommerce marketplace running vulnerable WCFM plugin versions, gaining legitimate low-privileged credentials through standard self-service onboarding. Using browser developer tools or intercepting proxy, the attacker crafts POST requests to the wcfm_modify_order_status AJAX endpoint, iterating through sequential order IDs to change high-value orders to 'cancelled' status, disrupting competitor sales and creating customer service chaos. Simultaneously, they invoke delete_wcfm_product with enumerated product IDs belonging to rival vendors, purging their catalog entries and causing immediate revenue loss. The attack requires only knowledge of WordPress AJAX endpoint conventions and minimal technical sophistication, with exploitation complexity rated low (AC:L) as no cryptographic bypass or race conditions are necessary-simple parameter manipulation achieves unauthorized access to global store resources.