CVE-2026-10041

MEDIUM

WCFM Frontend Manager for WooCommerce <= 6.7.27 - Authenticated Insecure Direct Object Reference

Title source: manual
STIX 2.1

Description

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.

References (12)

Core 12
Core References

Scores

CVSS v3 4.3
EPSS 0.0025
EPSS Percentile 16.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
wclovers/WCFM – Frontend Manager for WooCommerce < 6.7.27
Published Jul 11, 2026
Tracked Since Jul 11, 2026