What the vulnerability does
01Description
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Explanation of Vulnerability in Simple Terms
02Summary
WCFM – Frontend Manager for WooCommerce versions up to 6.7.24 contain an authorization bypass that allows high-privileged users to read, modify, or delete data without proper access controls. An attacker with administrative or vendor-level access can exploit this to access sensitive information or alter site content. Update to a version newer than 6.7.24 to remediate.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete sensitive data on the site with high-level privileges.
Potential impact on your site
04Site Impact
High-privilege accounts can bypass intended access restrictions, risking data theft or unauthorized changes.
Conditions required to exploit
05Prerequisites
Attacker must have high-level user privileges (admin or vendor account) on the site.
Key dates
06Disclosure timeline
February 9, 2026
CVE published
April 8, 2026
Record updated
