PT-2026-36617 · WordPress · Wcfm – Frontend Manager For Woocommerce+1

Supakiad S · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-2554

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress versions prior to 6.7.26

Description An Insecure Direct Object Reference (IDOR) exists due to missing validation on the customerid user-controlled key within the 'wcfm delete wcfm customer' function. This allows authenticated attackers with Vendor-level access or higher to delete arbitrary users, including Administrators. IDOR is a type of access control flaw that occurs when an application provides direct access to objects based on user-supplied input.

Recommendations Update the plugin to a version later than 6.7.25.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-2554

Affected Products

Bookings Subscription Listings Compatible

Wcfm – Frontend Manager For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2554 · Security Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386 · Note
• https://t.me/CVEtracker/52534 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3483695 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cve · Note
• https://t.me/cveNotify/161875 · Telegram Post