CVE-2026-12994: wclovers WCFM Frontend Manager for WooCommerce authorization bypass

CVE-2026-12994 · Severity: medium · CVSS 5.3 · Published 2026-07-11

A vulnerability in the WCFM Frontend Manager plugin for WooCommerce allows unauthorized individuals to interfere with store inquiries. Attackers can inject fake replies into customer support threads and trigger unwanted notification emails to both vendors and customers. This could lead to misinformation, reputational damage, and disruption of customer service operations.

Technologies: WC Lovers WCFM - Frontend Manager for WooCommerce. Vendors: WC Lovers.

Quick answers

Is CVE-2026-12994 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12994 being exploited in the wild.
How severe is CVE-2026-12994?
Medium severity, with a CVSS score of 5.3, published 11 July 2026.
Which products and versions are affected?
wclovers WCFM – Frontend Manager for WooCommerce <= 6.7.27.
Is there a fix for CVE-2026-12994?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12994 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12994?
Check whether you run WC Lovers WCFM - Frontend Manager for WooCommerce. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WCFM – Frontend Manager for WooCommerce plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the wcfm-my-account-enquiry-manage controller branch. Unlike other inquiry controllers, this specific branch fails to implement is_user_logged_in() or current_user_can() checks. Furthermore, the security nonce used for validation is exposed on public page loads, allowing unauthenticated network attackers to bypass the only existing barrier. Exploitation allows an attacker to overwrite inquiry records in the wp_wcfm_enquiries table, inject arbitrary reply content, and trigger automated notification emails.

Affected products

  • wclovers WCFM – Frontend Manager for WooCommerce <= 6.7.27

Timeline

  • 2026-07-11: disclosed: Initial publication of the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.