Executive brief
A security vulnerability exists in a popular WordPress plugin used to manage WooCommerce stores from the front end. This flaw allows users with 'Vendor' level accounts to delete or modify products, posts, and pages that they do not own, as well as change the status of any customer order. This could lead to significant business disruption, unauthorized order fulfillment changes, and loss of website content.
Technical details
The WCFM – Frontend Manager for WooCommerce plugin is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to missing validation on user-supplied object IDs within several AJAX actions. Specifically, the `wcfm_modify_order_status`, `delete_wcfm_article`, and `delete_wcfm_product` functions, along with the article management controller, fail to verify if the requesting user has ownership or authorization over the target ID. An authenticated attacker with Vendor-level privileges can exploit this by sending crafted AJAX requests to modify the status of any order or delete/modify any post, product, or page across the entire WordPress installation. The vulnerability is present in all versions up to and including 6.7.25.
Affected products
- wclovers WCFM – Frontend Manager for WooCommerce up to, and including, 6.7.25
Timeline
- 2026-04-04: advisory: Initial disclosure by Wordfence and NVD publication.
References
- https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-ajax.php?marks=644,880
- https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-article.php?marks=271
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f8248098-dff2-4bac-a138-aa40c7ab7a1c?source=cve