Security Alert Summary
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress contains an insecure direct object reference (IDOR) vulnerability that allows authenticated users with Vendor-level access and above to act on object IDs they do not own. Attacker-supplied object IDs are not properly validated, permitting modification of order status and deletion or modification of posts, products, and pages regardless of ownership.
CVE Details
- CVE ID: CVE-2026-4896
- Affected plugin or component: WCFM – Frontend Manager for WooCommerce and Bookings Subscription Listings Compatible plugin for WordPress
- Affected versions: All versions up to, and including, 6.7.25
- Published: April 4, 2026 at 8:16:06 AM UTC
- Last modified: April 4, 2026 at 8:16:06 AM UTC
- CVSS v3.1: Base Score 8.1; Severity HIGH; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Authentication / privileges / user interaction: Authentication required (attacker must have Vendor-level access or higher). Privileges required: Low (per CVSS). User interaction: None.
- Primary impact: Confidentiality: None; Integrity: High; Availability: High
- Weakness (CWE): CWE-639 (Authorization Bypass Through User-Controlled Key)
Technical Details
The vulnerability is an insecure direct object reference caused by missing validation of user-supplied object IDs. Multiple AJAX actions and controllers do not verify whether the authenticated user is authorized to act on the provided object identifier. The report names specific AJAX actions and controllers, including wcfm_modify_order_status, delete_wcfm_article, delete_wcfm_product, and the article management controller. Because the code accepts object IDs from the requester without validating ownership or access rights, an authenticated user with Vendor-level privileges or higher can change the status of arbitrary orders and delete or modify arbitrary posts, products, or pages regardless of ownership.
The impact is limited to integrity and availability effects described in the CVSS data: attackers can alter order data (for example, changing order status) and remove or modify content or products, which can disrupt storefront operations or content availability. The issue exists due to insufficient authorization checks on object identifiers supplied by users.
How This Could Impact Your Website
Consider a typical WooCommerce site with several user roles: the site owner, internal staff (store managers, editors), and external contributors or contractors. A vendor-level user or compromised vendor account could:
- Change order statuses for orders they do not own, leading to incorrect shipping, fulfillment, or refund workflows;
- Delete or modify product listings or pages, causing loss of product availability, broken purchase flows, or misleading content for customers;
- Create disruption to storefront operations and require restoration from backups if content or product data is removed.
The vulnerability does not indicate direct disclosure of confidential data in the CVE details, but tampered orders or content can still harm business operations and customer trust. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially vendor-level and contributor accounts.
- Enforce strong passwords and enable two-factor authentication for editors, administrators, and other privileged users.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site and order activity logs for unusual behavior, including unexpected order status changes or content deletions.
References
- https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-ajax.php?marks=644,880#L644
- https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-article.php?marks=271#L271
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f8248098-dff2-4bac-a138-aa40c7ab7a1c?source=cve
