WordSec
WordSec

WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers

2026-07-10 16:42
mrholmes

Strategic Overview

Status
Patched in 6.7.28
Affected PluginWCFM – Frontend Manager for WooCommerce
Affected Version<= 6.7.27
CVSS4.3Medium
CVECVE-2026-10041
View all WCFM – Frontend Manager for WooCommerce vulnerabilities

Vulnerability Overview

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.

Technical Analysis

REMEDIATION: Update to version 6.7.28, or a newer patched version --- IDENTIFIER: CWE-639 (Authorization Bypass Through User-Controlled Key) The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

External References

https://www.cve.org/CVERecord?id=CVE-2026-10041https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f88a18-5439-4759-ae9f-168f5efc3264

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C

WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers (CVE-2026-10041)