← All CVEs

CVE-2026-0845

7.2 HIGH

Published 2026-02-10 · Modified 2026-02-10 · Received

Quick Summary

A vulnerability in the WCFM plugin for WordPress allows users with Shop Manager access or higher to change any website setting. This is possible because the plugin fails to properly check if a user has permission before processing certain requests.

Who is affected

WordPress sites using the WCFM plugin up to version 6.7.24 are affected. An attacker with a Shop Manager account could change critical settings to take over the site or disrupt its operation.

Recommended fix

Immediately update the WCFM plugin to a version newer than 6.7.24. If an update is not available, consider disabling the plugin until a patched version is released.

Technical Description

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

CVSS Details

Attack Vector

NETWORK

Complexity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-862

References